WordPress OSM Map Widget for Elementor plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Button URL vulnerability discovered by zer0gh0st in WordPress Plugin OSM Map Widget for Elementor versions = 1.3.0...

Malicious code in @zalastax/nolb-osm (npm)

The package @zalastax/nolb-osm was found to contain malicious code...

MAL-2025-12854 Malicious code in @zalastax/nolb-osm (npm)

The package @zalastax/nolb-osm was found to contain malicious code...

CVE-2024-48729

An issue in ETSI Open-Source MANO OSM 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users component...

CVE-2024-3603

The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osmmap' shortcode in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible...

CVE-2022-4676

The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

CVE-2018-25064

A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named...

Security Bulletin:The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting, affects watsonx.data

Summary The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osmmap' shortcode in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This could affe...

CVE-2025-27081 HPE NonStop OSM Service Connection Suite, Denial of Service vulnerability

A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Service...

CVE-2025-27081

CVE-2025-27081 affects HPE NonStop OSM Service Connection Suite. The connected sources indicate a local Denial of Service vulnerability impacting this product, with a CVSS v3.1 base score of 6.8 (AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Exploitation is described as local, requiring low privileges an...

Hewlett Packard Enterprise NonStop OSM Service Connection Suite 安全漏洞

Hewlett Packard Enterprise NonStop OSM Service Connection Suite is an open systems management OSM interface for Hewlett Packard Enterprise USA. A security vulnerability exists in Hewlett Packard Enterprise NonStop OSM Service Connection Suite that originates from a potential local denial of servi...

PT-2025-15965 · Hewlett Packard · Hpe Nonstop Osm Service Connection Suite

Name of the Vulnerable Software and Affected Versions: HPE NonStop OSM Service Connection Suite affected versions not specified Description: A potential security issue in HPE NonStop OSM Service Connection Suite could be exploited to allow a local Denial of Service. Recommendations: At the moment...

HPESBNS04836 rev.1 - HPE NonStop OSM Service Connection Suite, Denial of Service vulnerability

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. OSM Service Connection Suite T0682 - L-series SPRs prior to T0682L02^BBV - All L-series versions of the product are affected. CVSS Scores: | CVE | CVSS Vector | Base Score | | -...

CVE-2025-31557

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MiKa OSM osm allows DOM-Based XSS.This issue affects OSM: from n/a through = 6.1.13...

CVE-2025-31557 WordPress OSM plugin <= 6.1.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MiKa OSM osm allows DOM-Based XSS.This issue affects OSM: from n/a through = 6.1.13...

CVE-2025-31557

CVE-2025-31557 (OSM – OpenStreetMap) is an authenticated stored cross-site scripting vulnerability in the OSM WordPress plugin, affecting OpenStreetMap versions up to 6.1.6. The EU/ENISA entry confirms the issue as Stored XSS and indicates Patch/Remediation status as Unpatched in public advisorie...

CVE-2024-3604

The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'taggedfilter' attribute of the 'osmmapv3' shortcode in all versions up to, and including, 6.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2024-52355

CVE-2024-52355 (OSM – OpenStreetMap, Hyumika OSM) has concrete details in connected sources: a Stored Cross-Site Scripting (XSS) in the OpenStreetMap WordPress plugin, caused by improper input neutralization during web page generation. Affected software is the OSM – OpenStreetMap plugin (Hyumika ...

PT-2024-35197 · Unknown · Hyumika Osm

Name of the Vulnerable Software and Affected Versions: Hyumika OSM – OpenStreetMap versions through 6.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. It allows for Stored XSS, which means an attacker can...

Malicious code in osm-legal-speed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efce0e1706c67e16298e03b91dcd0069873eae6922136c002862891d7579ffc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...