CVE-2025-12251

OpenWGA 7.11.12 Build 737 — vulnerability in the Admin UI component enables cross-site scripting. The issue affects the Admin UI function; root cause is a flaw that allows remote execution of scripts. Impact is client-side data integrity/defense separation with potential for arbitrary script exec...

CVE-2025-12251 OpenWGA Admin UI cross site scripting

A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted ear...

Malicious Package

Overview jquery-ui-source is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2025-43909

Name of the Vulnerable Software and Affected Versions OpenWGA version 7.11.12 Build 737 Description A security issue exists in OpenWGA that allows for cross site scripting. The issue impacts an unknown function within the Admin UI component and can be initiated remotely. The exploit for this issu...

EUVD-2025-35950

Malicious code in jquery-ui-source npm...

MAL-2025-48608 Malicious code in jquery-ui-source (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6feb40c9d7a44c987c085d658198139fcdd2fdf8b0000dab67f486d3271a036 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jquery-ui-source (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6feb40c9d7a44c987c085d658198139fcdd2fdf8b0000dab67f486d3271a036 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-2 (npm)

The package ui-2 was found to contain malicious code...

MAL-2025-48767 Malicious code in ui-2 (npm)

The package ui-2 was found to contain malicious code...

CVE-2025-12104

Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

MAL-2025-48814 Malicious code in circuit-runtime-ui-test (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in circuit-runtime-ui-test (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in circuit-runtime-ui (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-48813 Malicious code in circuit-runtime-ui (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-12104

Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-12104

CVE-2025-12104 affects Azure Access Technology BLU-IC2 and BLU-IC4 (through version 1.19.5). Connected sources consistently attribute the issue to outdated and vulnerable UI dependencies in these devices. The root cause is the use of insecure UI components, with high-impact indicators (CVE record...

Azure Access Technology BLU-IC2 安全漏洞

The Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 are both networked access controllers from Azure Access Technology, USA. A security vulnerability exists in Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 that stems from the use of outdated and vulnerabl...

EUVD-2025-34902

ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal...

Cross-site Scripting (XSS)

Overview ezsystems/ezplatform-admin-ui is a package that is part of the eZ Platform Admin UI Bundle. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the reschedule/cancel-schedule modal in the back office interface. An attacker can execute arbitrary scripts by...

GHSA-27GC-WJ6X-9W55 Keycloak error_description injection on error pages that can trigger phishing attacks

Keycloak’s account console accepts arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages e.g., fake support phone numbers or...