EUVD-2021-0213

Malware in sbrugna...

GHSA-W765-JM6W-4HHJ Webrecorder packages are vulnerable to XSS through 404 error handling logic

A Reflected Cross-Site Scripting XSS vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL derived from the original request target is directly embedded into an inline block without sanitization or escaping. This allows an attacker to craft ...

@cllu/awp-sw (=0.4.4) potentially affected by CVE-2025-58765 via @webrecorder/wabac (=2.17.3)

@webrecorder/wabac NPM version =2.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on @webrecorder/wabac and may be impacted: - @cllu/awp-sw =0.4.4 Source cves: CVE-2025-58765 Source advisory: OSV:GHSA-W765-JM6W-4HHJ...

@cllu/awp-sw (=0.4.4) potentially affected by CVE-2025-58765 via @webrecorder/wabac (=2.17.3)

@webrecorder/wabac NPM version =2.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on @webrecorder/wabac and may be impacted: - @cllu/awp-sw =0.4.4 Source cves: CVE-2025-58765 Source advisory: SNYK:JS-WEBRECORDERWABAC-12670884...

CVE-2021-39286

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped...

CVE-2021-39286

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped...

CVE-2021-39286

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped...

PYSEC-2021-120

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped...

Cross site scripting

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped...

PYSEC-2021-120

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped...

CVE-2021-39286

Webrecorder pywb before 2.6.0 is vulnerable to cross-site scripting (XSS) because Jinja2 templates are not automatically escaped. The CVE-2021-39286 entry is supported by multiple connected sources (e.g., GHSA-947X-PV47-PP3Q, OSV, CVE records) describing the same issue. Impact is XSS in affected ...

CVE-2021-39286

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped...