26 matches found
CVE-2026-113350
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...
EUVD-2026-104921
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...
CVE-2026-113350
The react-admin framework, in versions before 5.15.5 , is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause lies in the UrlField and FileField components, which fail to properly sanitize inputs, allowing attackers to inject javascript: URIs into backend record fields...
CVE-2026-113350 react-admin before 5.15.5 Stored XSS via UrlField and FileField
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...
CVE-2026-113350
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...
CVE-2026-113350 react-admin before 5.15.5 Stored XSS via UrlField and FileField
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...
CVE-2026-113350 react-admin before 5.15.5 Stored XSS via UrlField and FileField
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...
PT-2026-118334
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...
marmelab react-admin Cross-Site Scripting Vulnerability
Marmelab React-Admin versions prior to 5.15.5 have a cross-site scripting vulnerability. This vulnerability stems from a storage-based cross-site scripting issue. Attackers can inject JavaScript: URI injection scripts into record fields rendered by UrlField and FileField. When an administrator...
CVE-2023-25572
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and usi...
EUVD-2023-0631
Malicious code in bioql PyPI...
openstad-react-admin (0.1.29) potentially affected by CVE-2023-25572 via ra-ui-materialui (3.9.5)
ra-ui-materialui NPM version 3.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on ra-ui-materialui and may be impacted: - openstad-react-admin 0.1.29 Source cves: CVE-2023-25572 Source advisory: GHSA-5JCR-82FH-339V...
GHSA-5JCR-82FH-339V Cross-Site-Scripting attack on `<RichTextField>`
Impact All React applications built with react-admin and using the are affected. outputs the field value using dangerouslySetInnerHTML without client-side sanitization. If the data isn't sanitized server-side, this opens a possible Cross-Site-Scripting XSS attack. Proof of concept: jsx import...
@savvycodes/openstad-react-admin (>=0.31.1, <=0.40.1-alpha.3), muffin-admin (>=1.21.1, <=1.29.0) +4 more potentially affected by CVE-2023-25572 via react-admin (>=3.9.5, <=3.19.11)
react-admin NPM version =3.9.5, =0.31.1, =1.21.1, =0.1.0, =1.0.0, =1.0.3 Source cves: CVE-2023-25572 Source advisory: GHSA-5JCR-82FH-339V...
@savvycodes/openstad-react-admin (>=0.31.1, <=0.40.1-alpha.3), muffin-admin (>=1.21.1, <=1.29.0) +4 more potentially affected by CVE-2023-25572 via react-admin (>=3.9.5, <=3.19.11)
react-admin NPM version =3.9.5, =0.31.1, =1.21.1, =0.1.0, =1.0.0, =1.0.3 Source cves: CVE-2023-25572 Source advisory: OSV:GHSA-5JCR-82FH-339V...
openstad-react-admin (0.1.29) potentially affected by CVE-2023-25572 via ra-ui-materialui (3.9.5)
ra-ui-materialui NPM version 3.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on ra-ui-materialui and may be impacted: - openstad-react-admin 0.1.29 Source cves: CVE-2023-25572 Source advisory: OSV:GHSA-5JCR-82FH-339V...
CVE-2023-25572
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and usi...
Cross site scripting
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and usi...
CVE-2023-25572
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and usi...
@api-platform/admin (>=0.5.0, <=1.0.2), @bishoy_melek_wadie/react-admin-firebase (>=0.9.0, <=0.9.1) +71 more potentially affected by CVE-2023-25572 via react-admin (>=2.4.2, <=3.19.11)
react-admin NPM version =2.4.2, =0.5.0, =0.9.0, =0.0.1, =1.0.0, =0.6.5, =2.8.0, =0.6.3, =0.8.11, =1.0.1, =1.0.0, =1.0.0, =1.1.4 and more Source cves: CVE-2023-25572 Source advisory: MEND:CVE-2023-25572...