CVE-2025-34157

CVE-2025-34157 concerns Coolify. A stored XSS in the project-creation workflow affects versions prior to 4.0.0-beta.420.6. An authenticated user with low privileges can craft a project name containing JavaScript, which when an administrator deletes the project executes in the admin context, enabl...

Malicious code in icicle-jade-ysp547-project (npm)

The package icicle-jade-ysp547-project was found to contain malicious code...

Malicious code in project-yl4sx-lemon (npm)

The package project-yl4sx-lemon was found to contain malicious code...

Malicious code in dewdrop-kite-tea960-project (npm)

The package dewdrop-kite-tea960-project was found to contain malicious code...

Malicious code in umbra-tide-ehe932-project (npm)

The package umbra-tide-ehe932-project was found to contain malicious code...

Malicious code in xylophone-brook-uti375-project (npm)

The package xylophone-brook-uti375-project was found to contain malicious code...

MAL-2025-30371 Malicious code in project-mwi5v-mike (npm)

The package project-mwi5v-mike was found to contain malicious code...

Malicious code in project-fbywc-mango (npm)

The package project-fbywc-mango was found to contain malicious code...

MAL-2025-30084 Malicious code in project-d56rk-zucchini (npm)

The package project-d56rk-zucchini was found to contain malicious code...

Malicious code in project-eh7vv-yankee (npm)

The package project-eh7vv-yankee was found to contain malicious code...

MAL-2025-27960 Malicious code in nymph-nectar-pel131-project (npm)

The package nymph-nectar-pel131-project was found to contain malicious code...

MAL-2025-29835 Malicious code in project-4h5ip-ugli (npm)

The package project-4h5ip-ugli was found to contain malicious code...

CVE-2024-25218

A cross-site scripting XSS vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php...

CVE-2022-32567

The Appfire Jira Misc Custom Fields JMCF app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function...

CVE-2022-32274

The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function...

CVE-2021-45456

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...

CVE-2021-24382

The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of th...

CVE-2025-46825 Kanboard has stored Cross-site Scripting vulnerability in project name

Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting XSS Vulnerability in the name parameter of the http://localhost/?controller=ProjectCreationController&action=create form. This vulnerability allows...

CVE-2025-46825 Kanboard has stored Cross-site Scripting vulnerability in project name

Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting XSS Vulnerability in the name parameter of the http://localhost/?controller=ProjectCreationController&action=create form. This vulnerability allows...

Improper Ownership Management

Overview Affected versions of this package are vulnerable to Improper Ownership Management for projects, whose namespace defaults to being the project name, regardless of cluster. A user with permission to create a project can escalate privileges to those of a user who owns a project by the same...