CVE-2020-1060

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1035, CVE-2020-1058, CVE-2020-1093...

CVE-2020-1035

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1058, CVE-2020-1060, CVE-2020-1093...

CVE-2019-1238

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1239...

CVE-2019-1390

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'...

CVE-2019-1485

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'...

CVE-2019-1208

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1236...

CVE-2019-1239

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1238...

CVE-2019-1236

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1208...

CVE-2019-19160

Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscript into the configure filerxp...

CVE-2019-0842

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'...

Horabot Malware Targets 6 Latin American Nations Using Invoice-Themed Phishing Emails

Cybersecurity researchers have discovered a new phishing campaign that's being used to distribute malware called Horabot targeting Windows users in Latin American countries like Mexico, Guatemala, Colombia, Peru, Chile, and Argentina. The campaign is "using crafted emails that impersonate invoice...

MAL-2025-615 Malicious code in marked-as (npm)

This package is imitating the popular marked library. It contains a VBScript to extract a bundled PE payload, make it hidden, and execute it. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16c9c50d2f56b3edc3a26ddebf2c1da3ef628b3aa1c8da23bc2e5b0b2b157dea Any compute...

Malicious code in marked-as (npm)

This package is imitating the popular marked library. It contains a VBScript to extract a bundled PE payload, make it hidden, and execute it. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16c9c50d2f56b3edc3a26ddebf2c1da3ef628b3aa1c8da23bc2e5b0b2b157dea Any compute...

Malicious code in marked-ps (npm)

This package deploys Windows gh0strat malware via VBScript. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c33f4820622bde56fc1bf9394cd1a6d5af92c7099d9fc2ed247a512cfc480372 Any computer that has this package installed or running should be considered fully compromise...

MAL-2025-69 Malicious code in marked-cs (npm)

This package deploys Windows gh0strat malware via VBScript --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f49714fc5f2d734162fbcc4c7c4552ec6d6e89b81109ba8652c3d057686022 Any computer that has this package installed or running should be considered fully compromised...

MAL-2025-70 Malicious code in marked-ps (npm)

This package deploys Windows gh0strat malware via VBScript. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c33f4820622bde56fc1bf9394cd1a6d5af92c7099d9fc2ed247a512cfc480372 Any computer that has this package installed or running should be considered fully compromise...

PT-2024-30532

Name of the Vulnerable Software and Affected Versions Ibexa RichText Field Type versions prior to 4.6.10 Description The validator for the RichText fieldtype blocklists javascript: and vbscript: in links to prevent XSS, but this can be circumvented using upper case, leaving other options open...

Cross Site Scripting (XSS)

@udecode/plate-media is vulnerable to Cross Site Scripting XSS. The vulnerability is due to lack of proper URL sanitization in MediaEmbedElement and custom urlParsers and direct consumption of the url property, which allows an attacker to embed malicious URLs using javascript:, data:, or vbscript...

CVE-2024-40631

Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...

Plate Security Breach

Plate is a plugin system for Ziad Beyens individual developers to make it easier to build fully functional editors. Plate has a security vulnerability that stems from when the editor uses the MediaEmbedElement component and passes custom urlParsers via the useMediaState hook, if the custom parser...