Prototype Pollution

Overview org.webjars.bower:canvg is a JavaScript SVG parser and renderer on Canvas. Affected versions of this package are vulnerable to Prototype Pollution in the StyleElement constructor. PoC js async = // Assuming import is set up properly import StyleElement from 'canvg'; // Output expected: "...

MAL-2025-352 Malicious code in no-style-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9044d80b8ff33b0d2a50511386c0fed003004f9452211938b949aca211b0866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @moneyguide-devkit/style-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d41e363cb9b67e73c6cfe2f5b71641d9289a57d80051c4e3e67b22db36574d8 The OpenSSF Package Analysis project identified '@moneyguide-devkit/style-provider' @ 1.0.1 npm as malicious. It is considered malicious because...

SUSE CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the...

WordPress plugin Gravity Forms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

PT-2025-2142 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Gravity Forms plugin for WordPress versions 2.9.0.1 through 2.9.1.3 Description: The issue concerns a Stored Cross-Site Scripting vulnerability via the style settings parameter due to insufficient input sanitization and output escaping. This...

CVE-2025-23801

Cross-Site Request Forgery CSRF vulnerability in FuzzGuard Style Admin style-admin allows Stored XSS.This issue affects Style Admin: from n/a through = 1.4.3...

CVE-2025-23424

Cross-Site Request Forgery CSRF vulnerability in bnovotny Marquee Style RSS News Ticker marquee-style-rss-news-ticker allows Cross Site Request Forgery.This issue affects Marquee Style RSS News Ticker: from n/a through = 3.2.0...

CVE-2025-23801

CVE-2025-23801: CSRF in Style Admin plugin allows Stored XSS affecting Style Admin versions n/a–1.4.3. CVSS 3.1 base score 7.1 (HIGH). No exploitation details provided in the connected documents; remediation status not explicitly stated. Recommend upgrading Style Admin to a version beyond 1.4.3 o...

CVE-2025-23801 WordPress Style Admin Plugin <= 1.4.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in FuzzGuard Style Admin style-admin allows Stored XSS.This issue affects Style Admin: from n/a through = 1.4.3...

CVE-2025-23801 WordPress Style Admin Plugin <= 1.4.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in FuzzGuard Style Admin style-admin allows Stored XSS.This issue affects Style Admin: from n/a through = 1.4.3...

CVE-2025-23424

CVE-2025-23424 affects the Marquee Style RSS News Ticker plugin. Connected sources indicate a Cross-Site Request Forgery (CSRF) vulnerability that can lead to a Stored Cross-Site Scripting (XSS) condition in Marquee Style RSS News Ticker versions up to 3.2.0. The CVSS baseline is 7.1 (AV:N/AC:L/P...

CVE-2025-23424 WordPress Marquee Style RSS News Ticker plugin <= 3.2.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in bnovotny Marquee Style RSS News Ticker marquee-style-rss-news-ticker allows Cross Site Request Forgery.This issue affects Marquee Style RSS News Ticker: from n/a through = 3.2.0...

WordPress Style Admin Plugin <= 1.4.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Style Admin versions = 1.4.3...

WordPress Marquee Style RSS News Ticker plugin <= 3.2.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Marquee Style RSS News Ticker versions = 3.2.0...

CVE-2025-20072

Mattermost Mobile versions = 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input...

CVE-2025-20072 Mobile crash via improper validation of proto style in attachments

Mattermost Mobile versions = 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input...

CVE-2025-20072 Mobile crash via improper validation of proto style in attachments

Mattermost Mobile versions = 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input...

WordPress plugin Style Admin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Mattermost Mobile Apps 安全漏洞

Mattermost Mobile is a mobile application project, developed using the React Native framework, designed to provide a cross-platform iOS and Android client for Mattermost. Mattermost Mobile suffers from a denial of service vulnerability that stems from an inability to properly validate the proto...