Cross site scripting

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

CVE-2021-32702 Reflected XSS from the callback handler's error query parameter

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

Cross-site Scripting

nextjs-auth0 lacks HTML escaping for error messages...

ZEIT Next.js Input Validation Error Vulnerability

ZEIT Next.js is a ZEIT company based on Vue.js, Node.js, Webpack and Babel.js open source Web application framework. An input validation error vulnerability exists in ZEIT Next.js. The vulnerability stems from a web system or product that does not properly validate input data. No detailed...

ZEIT Next.js path traversal vulnerability

ZEIT Next.js is a ZEIT company based on Vue.js, Node.js, Webpack and Babel.js open source Web application framework. A path traversal vulnerability exists in ZEIT Next.js versions prior to 9.3.2. The vulnerability stems from a failure of a web system or product to properly filter for special...

Next.js Cross-Site Scripting Vulnerability

Next.js is a lightweight framework for static applications. A cross-site scripting vulnerability exists in Next.js versions 7.0.0 and 7.0.1 on 404 or 500 /error pages, which can be exploited by a remote attacker to execute client-side code on these pages by sending a specially crafted request...

ZEIT Next.js Directory Traversal Vulnerability

Next.js is a minimalist server-side rendering framework for React applications. A directory traversal vulnerability exists in ZEIT Next.js versions prior to 2.4.1 under the /next and /static request namespaces. An attacker can exploit this vulnerability to obtain sensitive information...