36 matches found
MAL-2025-27077 Malicious code in nanotechnology-nodejs-library-nodemon (npm)
The package nanotechnology-nodejs-library-nodemon was found to contain malicious code...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
@lumieducation/h5p-server Fails to Sanitize Plain Text Strings
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
GHSA-M7GM-V253-56HH @lumieducation/h5p-server Fails to Sanitize Plain Text Strings
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828: Improper Neutralization of Input During Web Page Generation
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828
CVE-2025-47828 affects Lumi H5P-Nodejs-library before 9.3.3. The root cause is omission of sanitizeHtml for plain text strings, enabling potential Cross-Site Scripting (XSS) risks. Impact is limited to confidentiality and integrity with no reported availability impact; attack vector is network, w...
PT-2025-20649
Name of the Vulnerable Software and Affected Versions Lumi H5P-Nodejs-library versions prior to 9.3.3 Description The issue is related to the omission of a sanitizeHtml call for plain text strings. This could potentially lead to security issues, although specific details about the estimated numbe...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2024-34712: Relative Path Traversal
Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as Client.rest.channels.removeBan is not url-encoded, resulting in specially crafted input such as ../../../channels/id being normalized into the url /api/v10/channels/id, and deleting a...
AZL-39734 CVE-2024-30260 affecting package nodejs for versions less than 20.14.0-1
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch, but did not clear them for undici.request. This vulnerability was patched in versions 5.28.4 and 6.11.1...
CVE-2016-4991
Input passed to the Pdf function is shell escaped and passed to childprocess.exec during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This problem affects nodepdf 1.3....
nodejs-ini: Prototype pollution via malicious INI file
A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...