Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the improper origin checks of UI route submissions in server-side route action handlers in Framework Mode. An attacker can execute unauthorized actions by tricking a user into submitting a crafted...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the improper origin checks of UI route submissions in server-side route action handlers in Framework Mode. An attacker can execute unauthorized actions by tricking a user into submitting a crafted...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.7-alpha-20250916121934-9a6d7df081f77b13548a6a7e5478a1361f5c91e8) +209 more potentially affected by CVE-2025-59057 via react-router (>=7.0.0, <=7.8.2-pre.1)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =0.0.2, =3.4.0, =0.2.3, =1.1.0, =0.1.0, =3.0.0-alpha.2, =3.0.0-alpha.10, =15.0.12, =0.0.1-ssmch, =0.6.9-alpha-7 and more Source cves: CVE-2025-59057 Source advisory: OSV:GHSA-3CGP-3XVW-98X8...

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

Summary An unsafe implementation in the click event listener used by ui.subpages, combined with attacker-controlled link rendering on the page, causes an XSS when the user actively clicks on the link. Details 1. On click, eventually subpagesnavigate event is emitted...

Cross-site Scripting (XSS)

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ui.subpages function. An attacker can execute JavaScript in the context of the user's browser by tricking a user into clicking a...

Malicious code in @kyriba/ui-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7e92deb9c473f963b37b51df844bbea3a31ce650797efd9e410e27219be1f2 The package @kyriba/ui-workspace was found to contain malicious code. Source: ghsa-malware...

MAL-2026-166 Malicious code in @kyriba/ui-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7e92deb9c473f963b37b51df844bbea3a31ce650797efd9e410e27219be1f2 The package @kyriba/ui-workspace was found to contain malicious code. Source: ghsa-malware...

CVE-2026-21873 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.subpages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been...

CVE-2026-21872 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.subpages, combined with attacker-controlled link rendering on the page, causes XSS when the user actively clicks on the link. This issue has been patched in versi...

NiceGUI 跨站脚本漏洞

NiceGUI is NiceGUI open source an easy to use, Python based UI framework. A cross-site scripting vulnerability exists in NiceGUI versions 2.13.0 through 3.4.1, which stems from a cross-site scripting risk in the ui.navigate.history.push or replace function...

PT-2026-2111

Name of the Vulnerable Software and Affected Versions NiceGUI versions 2.22.0 through 3.4.1 Description NiceGUI is a Python-based UI framework susceptible to a cross-site scripting XSS issue. The problem stems from an unsafe implementation within the click event listener used by ui.sub pages,...

CVE-2025-62224

User interface ui misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network...

CVE-2025-62224

CVE-2025-62224 affects Microsoft Edge for Android. The issue is a UI misrepresentation of critical information in the browser, enabling a network-based spoofing scenario by an authorized attacker. Documented impact is spoofing of the user interface with low to medium severity in various sources; ...

MAL-2026-193 Malicious code in cko-ui-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bd7dceb0840c7e96ac7bbc186b43c5a28941546823b4a13888aad0870a5aaa9 The package cko-ui-toolkit was found to contain malicious code. Source: ghsa-malware 06a8bb4e74769e572fe928f5f3fa63fb6ebda995375148b063d1730c43c4dc06...

Malicious code in cko-ui-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bd7dceb0840c7e96ac7bbc186b43c5a28941546823b4a13888aad0870a5aaa9 The package cko-ui-toolkit was found to contain malicious code. Source: ghsa-malware 06a8bb4e74769e572fe928f5f3fa63fb6ebda995375148b063d1730c43c4dc06...

CVE-2025-31962

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods...

CVE-2019-12139

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4...

CVE-2025-1349

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

User interface ui misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network...

CVE-2025-31962 HCL BigFix IVR is impacted by an insufficient session expiration vulnerability

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods...