21 matches found
CVE-2026-22072: Improper Input Validation
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...
EUVD-2023-48448
Malicious code in bioql PyPI...
CVE-2025-27388: Improper Input Validation
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...
CVE-2025-25477: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...
CVE-2025-25477
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...
PT-2025-9042 · Syspass · Syspass
Name of the Vulnerable Software and Affected Versions: SysPass versions 3.2.x Description: A host header injection vulnerability in SysPass allows an attacker to load malicious JS files from an arbitrary domain, which would be executed in the victim's browser. Recommendations: For SysPass version...
CVE-2025-0060: Improper Control of Generation of Code
SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged...
CVE-2025-0057: Unrestricted Upload of File with Dangerous Type
SAP NetWeaver AS JAVA User Admin Application is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of...
North Korean Hackers Moonstone Sleet Push Malicious JS Packages to npm Registry
The North Korea-linked threat actor known as Moonstone Sleet has continued to push malicious npm packages to the JavaScript package registry with the aim of infecting Windows systems, underscoring the persistent nature of their campaigns. The packages in question, harthat-api and harthat-hash, we...
iFrame < 4.9 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape the srcdoc parameter, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, however given that the malicious JS is limited to the scope of the iframe, there is no practical way to make users su...
CVE-2023-44089: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FMS: from 700 through 774...
Cross-site Scripting (XSS)
com.jfinal, jfinal is vulnerable to Cross Site Scripting. The vulnerability exists due to improper validation or sanitization of user inputs which allows attackers to inject malicious JS payloads into the system...
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
Related issue & discussion: - https://github.com/ArchiveBox/ArchiveBox/issues/239 - https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overviewpublishing - https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archivesecurity-concerns Impact Any users who save untrusted URLs and view...
U.S. Dept Of Defense: CVE-2023-24488 xss on https://██████/
Vulnerability description not provided...
TD Bank: Reflected XSS on marketsandresearch.td.com
Summary: Hi TD security team, there is a reflected XSS vulnerability at http://marketsandresearch.td.com. As you are most likely aware, XSS vulnerabilities can have significant security implications, including allowing an attacker to inject malicious JS code into the application, which is then...
parse-url cross-site scripting vulnerability
parse-url is an advanced url parser with git url support. A cross-site scripting vulnerability exists in parse-url versions prior to 7.0.0, which stems from the ability to run malicious JS code using ASCII characters starting with and all special escape characters starting with Unicode, which can...
parse-url cross-site scripting vulnerability
parse-url is an advanced url parser with git url support. A cross-site scripting vulnerability exists in parse-url versions prior to 7.0.0, which stems from a last fix can be bypassed and can be exploited by an attacker to place any malicious JS code on a web page...
Sensitive Cookie Without 'HttpOnly' Flag in namelessmc/nameless
Description Due to a culmination of factors in the design of the authentication and authorization system and a lack of proper cookie setting it is possible for a malicious user to exfiltrate session tokens from a NamelessMC instance and aggregate them in a remote service. A malicious administrati...
VOOKI - Web Application Vulnerability Scanner
Vooki is a free web application vulnerability scanner. Vooki is a user-friendly tool that you can easily scan any web application and find the vulnerabilities. Vooki includes Web Application Scanner, Rest API Scanner, and reporting section. Vooki – Web Application Scanner can help you to find the...
PhpBB2 Custom Mass PM 1.4.7 Cross Site Scripting
No description provided by source. ^ Exploit title: PhpBB2 Module "Custom Mass PM" Cross Site Scripting Vulnerability ^ Author : Silic0n sciencemedia017Atyahoo.com ^ MOD Title: Custom mass PM ^ MOD Description: Add mass PM functionnality to group members or all forums members for authorized users...