PT-2025-16230

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue is related to Reflected XSS Cross-site Scripting attacks. It occurs when a user creates new form fields, which can introduce new parameters vulnerable to XSS...

CVE-2024-13597: Improper Neutralization of Input During Web Page Generation

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a form sent to login panel at /softcom/ with a malicious script, what causes the script to run in user's context. This vulnerability ha...

CVE-2024-10088: Improper Neutralization of Input During Web Page Generation

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS Cross-site Scripting attacks. An attacker might trick a user into filling a login form with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in...

CVE-2024-49709: Session Fixation

Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser might set such a cookie, wait until the user logs in and then use the same cookie to take over the account. Moreover, the system does not...

CVE-2024-13598: Improper Neutralization of Input During Web Page Generation

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS Cross-site Scripting attacks. Using a functionality of creating new form fields one creates new parameters vulnerable to XSS attacks. A user tricked into filling such a form with a malicious script will run th...

PT-2025-16233

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0 Description: The issue concerns a Stored XSS Cross-site Scripting attack. An attacker can trick a user into filling a form designed for setting delivery address with a malicious script,...

CVE-2025-29036

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component...

CVE-2025-29036

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component...

CVE-2025-29036

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component...

CVE-2025-29036

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component...

CVE-2025-29036

The hackathon-starter application (version 8.1.0 ) contains a vulnerability in the user.js component. This flaw allows a remote attacker to achieve privilege escalation , potentially gaining higher access levels and enabling further exploitation of the system. As a workaround, it is recommended t...

CVE-2025-29036: Incorrect Privilege Assignment

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component...

CVE-2025-29036

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component...

PT-2025-14381 · Unknown · Hackathon-Starter

Name of the Vulnerable Software and Affected Versions: hackathon-starter version 8.1.0 Description: The issue allows a remote attacker to escalate privileges via the user.js component. This enables the attacker to gain higher access levels, potentially leading to further exploitation of the syste...

Hackathon Starter 安全漏洞

Hackathon Starter is a sample Node.js web application by the individual developer Sahat Yalkabov. A security vulnerability exists in Hackathon Starter version 8.1.0, which stems from a user.js component that could lead to elevation of privilege...

CVE-2025-29036

An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component...

CVE-2024-12189: Improper Neutralization of Input During Web Page Generation

The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This...

Malicious code in gatsby-starter-hello-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6c7747634dd4e3ce4eb97de472957ba6fd913f4eff5887068d5d266c4957908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2508 Malicious code in gatsby-starter-hello-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6c7747634dd4e3ce4eb97de472957ba6fd913f4eff5887068d5d266c4957908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hardhat-ethers-react-ts-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8762e2209b41b4f6eb94a4d56674ed8d23f5ecba64034e0825fe7490fea5c78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...