39014 matches found
CVE-2026-22610 Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting XSS vulnerability has been identified in the Angular Template Compiler. The...
@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.160) +26 more potentially affected by CVE-2026-22610 via @angular/compiler (>=20.0.0, <=20.3.15)
@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =12.0.0-14, =13.0.0-1 and more Source cves: CVE-2026-22610 Source advisory: SNYK:JS-ANGULARCOMPILER-14908872...
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
A cross-site scripting XSS vulnerabilities was identified in October CMS backend configuration forms: - Editor Settings Markup Styles A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Settings → Editor Settings → Markup Styles. A special...
CVE-2023-49213
The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1...
CVE-2023-31250
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...
CVE-2023-4820
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin...
CVE-2023-4757
The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could...
CVE-2023-40743
UNSUPPORTED WHEN ASSIGNED When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose...
CVE-2025-13854
The Curved Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'radius' parameter of the arctext shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2018-4338
A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14...
CVE-2018-4396
A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14...
CVE-2018-4335
A validation issue was addressed with improved input sanitization. This issue affected versions prior to iOS 12...
CVE-2018-4346
A validation issue existed which allowed local file access. This was addressed with input sanitization. This issue affected versions prior to macOS Mojave 10.14...
CVE-2018-4418
A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14...
CVE-2021-41917
webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in the clients section, due to incorrect sanitization of user-supplied data and achieve a Stored Cross-Site Scripting attack against the platform users and...
CVE-2021-41315
The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker with access to the console application to execute arbitrary OS commands and escalate privileges...
CVE-2021-31643
An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter...
CVE-2021-31274
In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...
CVE-2021-22910
A sanitization vulnerability exists in Rocket.Chat server versions 3.13.2, 3.12.4, 3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE...