365 matches found
Directus is Vulnerable to Stored Cross-site Scripting
Summary A stored cross-site scripting XSS vulnerability exists that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy CSP restrictions by combining file uploads with iframe srcdo...
GHSA-VV2V-PW69-8CRF Directus is Vulnerable to Stored Cross-site Scripting
Summary A stored cross-site scripting XSS vulnerability exists that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy CSP restrictions by combining file uploads with iframe srcdo...
CVE-2025-64747
CVE-2025-64747 describes a stored XSS in Directus prior to version 11.13.0. Attackers with upload files and edit item permissions can inject JavaScript via the Block Editor interface. The technique exploits insufficient sanitization and uses an iframe with a srcdoc attribute to bypass CSP, enabli...
EUVD-2025-119988
The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing malicious JavaScript code, which will execute on the client side when a user is tricked into visiting a specific URL...
CVE-2025-63307
The CVE-2025-63307 issue affects alexusmai/laravel-file-manager v3.3.1. It describes a Cross-Site Scripting (XSS) vulnerability where user-controlled uploads/renames of HTML and SVG files are served inline without adequate content-type validation or output sanitization, enabling stored XSS. Sever...
CVE-2025-41723
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations...
EUVD-2006-0257
Malware in sbrugna...
EUVD-2007-5815
Malware in sbrugna...
EUVD-2005-0855
Malware in sbrugna...
EUVD-2006-7064
Malware in sbrugna...
EUVD-2002-1075
Malware in sbrugna...
EUVD-2021-11085
Malware in sbrugna...
EUVD-2025-26723
Malicious code in bioql PyPI...
EUVD-2023-48077
Malicious code in bioql PyPI...
EUVD-2023-3135
Malicious code in bioql PyPI...
EUVD-2025-25488
Malicious code in bioql PyPI...
EUVD-2023-31616
Malicious code in bioql PyPI...
NewType Infortech NUP Portal 访问控制错误漏洞
NewType Infortech NUP Portal is a portal management and collaborative office software system from NewType Infortech Taiwan, China. An access control error vulnerability exists in NewType Infortech NUP Portal, which stems from a lack of authentication and could allow an unauthenticated remote...
CVE-2025-25048
CVE-2025-25048 affects IBM Engineering Lifecycle Management - Jazz Foundation (versions 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002). The issue is a Relative Path Traversal caused by improper neutralization of sequences that can resolve to a restricte...