52802 matches found
NPM: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
NPM: Nuxt: Server-side route rules redirect, headers, proxy, ssr are skipped for case-variant paths when routing is case-insensitive vulnerability discovered by ? in WordPress Npm nuxt versions = 3.0.0, 4.0.0...
NPM: Nuxt server islands render `useHeadSafe` input without sanitisation
NPM: Nuxt server islands render useHeadSafe input without sanitisation vulnerability discovered by ? in WordPress Npm nuxt versions = 3.13.0, 4.6.2...
NPM: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
NPM: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a javascript: URL prefixed with an ASCII control character executes from when pages is disabled vulnerability discovered by ? in WordPress Npm nuxt versions 4.6.0...
NPM: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
NPM: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass appMiddleware on dynamic and catch-all routes vulnerability discovered by ? in WordPress Npm nuxt versions = 3.11.0, 3.21.4...
NPM: Electron: SameSite cookie restrictions are not applied to windows opened from links
NPM: Electron: SameSite cookie restrictions are not applied to windows opened from links vulnerability discovered by ? in WordPress Npm electron versions 42.11.3...
NPM: Electron: Pointer lock permission requests can be attributed to the wrong frame
NPM: Electron: Pointer lock permission requests can be attributed to the wrong frame vulnerability discovered by ? in WordPress Npm electron versions 42.11.9...
NPM: Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
NPM: Electron: Extension tabs.query returns tab URLs and titles without the tabs permission vulnerability discovered by ? in WordPress Npm electron versions 42.11.1...
NPM: Electron: Frame subscription trusts GPU-supplied frame geometry
NPM: Electron: Frame subscription trusts GPU-supplied frame geometry vulnerability discovered by ? in WordPress Npm electron versions 42.11.6...
NPM: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
NPM: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry vulnerability discovered by ? in WordPress Npm electron versions 42.11.6...
NPM: Electron: openExternal permission requests can be attributed to the wrong origin
NPM: Electron: openExternal permission requests can be attributed to the wrong origin vulnerability discovered by ? in WordPress Npm electron versions 42.11.3...
NPM: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
NPM: Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, = 16.4.0...
NPM: fastify is vulnerable to header validation bypass via case-sensitive propertyNames
NPM: fastify is vulnerable to header validation bypass via case-sensitive propertyNames vulnerability discovered by ? in WordPress Npm fastify versions = 5.12.2, 5.12.6...
NPM: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
NPM: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype vulnerability discovered by ? in WordPress Npm tome versions = 5.0.0...
NPM: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
NPM: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse vulnerability discovered by ? in WordPress Npm toml versions = 5.0.0...
NPM: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
NPM: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse vulnerability discovered by ? in WordPress Npm toml versions = 5.0.0...
NPM: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
NPM: toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse vulnerability discovered by ? in WordPress Npm toml versions = 5.0.0...
NPM: Storybook dev server vulnerable to code injection from the local network
NPM: Storybook dev server vulnerable to code injection from the local network vulnerability discovered by ? in WordPress Npm storybook versions = 8.0.0, 8.6.19...
NPM: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
NPM: Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering vulnerability discovered by ? in WordPress Npm astro versions 7.3.2...
NPM: Astro: Arbitrary CSS injection in Astro View Transitions
NPM: Astro: Arbitrary CSS injection in Astro View Transitions vulnerability discovered by ? in WordPress Npm astro versions = 7.1.0, = 7.3.2...
NPM: DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
NPM: DOMPurify SAFEFORTEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.4, = 3.4.16...
NPM: DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
NPM: DOMPurify INPLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed incomplete fix for GHSA-p98j-92pf-mc4p vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.16...
NPM: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
NPM: DOMPurify: SMIL attributeName=href guard is skipped when PARSERMEDIATYPE is application/xhtml+xml vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.16...
NPM: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
NPM: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.3...
NPM: next.js cache leak across root param values in nested 'use cache' functions
NPM: next.js cache leak across root param values in nested 'use cache' functions vulnerability discovered by ? in WordPress Npm next versions = 16.3.0, 16.3.8...
NPM: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
NPM: Nodemailer: Quadratic On^2 DKIM header unfolding lets a large folded header cause remote denial of service during signing vulnerability discovered by ? in WordPress Npm nodemailer versions = 3.0.0, = 10.0.9...
NPM: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
NPM: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used vulnerability discovered by ? in WordPress Npm next versions = 10.0.0, = 15.5.27...
NPM: Next.js: Denial of Service in App Router using Server Actions
NPM: Next.js: Denial of Service in App Router using Server Actions vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, = 15.5.27...
NPM: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
NPM: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving Odepth^2 CPU denial of service vulnerability discovered by ? in WordPress Npm stream-json versions = 2.0.0, = 3.6.0...
WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Extensions for Leaflet Map versions = 6.0...
WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ND Shortcodes For Visual Composer versions = 7.8...
WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Waitlist Woocommerce Back in stock notifier versions = 2.9.1...
WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Restaurant Menu – Food Ordering System – Table Reservation versions = 2.4.4...
WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Sanjeev Kumar in WordPress Plugin ЮKassa для WooCommerce versions = 2.17.3...
WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by dcs in WordPress Plugin ShopMagic versions = 4.9.1...
WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by HAIMIN in WordPress Plugin Majestic Support versions = 1.2.1...
WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by souparna majumder in WordPress Plugin Page Restriction WordPress WP versions = 1.6.0...
WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by HarshG in WordPress Plugin Sunshine Photo Cart versions = 3.7.5...
WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.2...
WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ihsan Saddan in WordPress Plugin Off-Canvas Sidebars & Menus Slidebars versions = 0.5.9...
WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.2...
WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by MYUNGYONG LEE in WordPress Plugin myCred versions = 4.0.0-beta.1...
WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin PowerPack Addons for Elementor versions = 3.1.0...
WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by mroccon in WordPress Plugin Strong Testimonials versions = 3.3.14...
WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by HAIMIN in WordPress Plugin Falcon – WordPress Optimizations & Tweaks versions = 2.12.0...
WordPress Jane Menu plugin < 1.5.1 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Jane Menu versions 1.5.1...
WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Andrei in WordPress Plugin Metform versions = 4.3.2...
WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin MarketKing versions = 2.1.72...
WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by beopseong.kim in WordPress Plugin Xpro Elementor Addons versions = 1.7.10...
WordPress Translate WordPress with Weglot 2.0 plugin < 6.4.3 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Weglot Translate versions 6.4.3...