Command Injection

jtrussell/semver-tags is vulnerable to Command Injection The vulnerability exists due to improper user-input sanitization in the getGitTagsRemote function, which allows an attacker to execute arbitrary commands...

CVE-2023-0942 Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting

The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2020-36656 Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks...

PT-2023-11824 · WordPress · Spectra

Name of the Vulnerable Software and Affected Versions: Spectra WordPress plugin versions prior to 1.15.0 Description: The issue allows contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks due to insufficient sanitization of user input in the style HTML attribute...

create-choo-app3 is vulnerable to Command Injection via the devInstall function

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

Cross-site Scripting (XSS)

eta is vulnerable to Cross-site Scripting XSS. The vulnerability exists in file-handlers.ts due to improper user-input sanitization from the Express API allowing an attacker to inject and execute malicious JavaScript...

CVE-2022-25855

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

Command injection

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25855

The CVE-2022-25855 entry concerns the npm package create-choo-app3, with a documented Command Injection vulnerability in the devInstall function due to improper user-input sanitization. Multiple connected sources (Red Hat, GHSA, OSV, CNVD, SNYK, CVE lists) confirm the issue affects all versions a...

CVE-2022-25855

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25855

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

jSuites subect to Cross-site Scripting

Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the Editor function...

CVE-2022-25979

Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the Editor function...

CVE-2022-25979

Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the Editor function...

CVE-2022-25979

Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the Editor function...

Cross-Site Scripting (XSS)

phpmyfaq is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to improper user input sanitization in add.php which allows an attacker to inject and execute arbitrary scripts...

Command Injection in create-choo-electron

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25908

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

Command injection

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25908

CVE-2022-25908 affects the Node.js module create-choo-electron, with all versions vulnerable to Command Injection via the devInstall function due to improper input validation. Connected IBM advisories tie this to IBM Storage Ceph and IBM Maximo MAS deployments, describing feasible command executi...