Malicious code in sechub-website (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2019-15896

An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The uploadimport function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation administrator account creation, website redirection...

CVE-2019-19670

A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1. A successful exploit can result in stored XSS, website defacement, etc. via ExtraHTTPHeader to RAPR/WebSettingsGeneralSet.html...

CVE-2019-7553

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...

CVE-2019-8911

An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...

CVE-2019-8654

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.1. Visiting a malicious website may lead to user interface spoofing...

CVE-2019-3665

Code Injection vulnerability in the web interface in McAfee Web Advisor WA prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would normally have blocked via a carefully crafted web site...

CVE-2019-8727

A logic issue was addressed with improved state management. This issue is fixed in iOS 13. Visiting a malicious website may lead to address bar spoofing...

CVE-2018-17840

SQL injection exists in Scriptzee Education Website 1.0 via the collegelist.html subject, city, or country parameter...

CVE-2011-3817

Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/media/parameters.php and certain other files. NOTE: this might overlap CVE-2005-2436...

CVE-2011-2892

Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2017-1000461

Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...

CVE-2017-20150

A vulnerability was found in challenge website. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is f1644b1d3502e5aa5284f31ea80d2623817f4d42. It is recommended to apply a patch to fix this issue. The identifi...

CVE-2011-5088

The GENESIS32 IcoSetServer ActiveX control in ICONICS GENESIS32 9.21 and BizViz 9.21 configures the trusted zone on the basis of user input, which allows remote attackers to execute arbitrary code via a crafted web site, related to a "Workbench32/WebHMI component SetTrustedZone Policy...

CVE-2009-3162

Cross-site scripting XSS vulnerability in Multi Website 1.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to the default URI...

CVE-2002-2413

WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that uses the equivalent 8.3 file name...

CVE-1999-0177

The uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs...

The vulnerability of the VMware Aria Automation (previously vRealize Automation) software, a virtualization platform from VMware Cloud Foundation, and the VMware Telco Cloud Platform, a telecommunications cloud platform, stems from the lack of security measures for the website structure. This allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the VMware Aria Automation previously vRealize Automation software, as well as the VMware Cloud Foundation virtualization platform and the VMware Telco Cloud Platform cloud communication platform, is related to the lack of security measures for the website structure. Exploiti...

webkitgtk: A malicious website may exfiltrate data cross-origin

A flaw was found in WebKitGTK. A malicious website may steal data cross-origin due to improper security checks within the web browser or rendering engine, leading to unauthorized disclosure of information...

CVE-2025-47939

TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restrictio...