CVE-2022-1295

Prototype Pollution in fullpage.js (CVE-2022-1295) affects the library prior to 4.0.2, via the internal deepExtend utility (window.fp_utils) enabling pollution of Object prototypes. Multiple sources (GHSA, OSV, NVD/nvd, Red Hat, Huntr) confirm the issue and describe the impact as potentially enab...

CVE-2022-1330

CVE-2022-1330 affects the fullpage.js library prior to 4.0.4. The vulnerability is a stored cross-site scripting (XSS) flaw caused by unsanitized anchor URLs in href attributes, which can allow injected JavaScript when a page uses fullpage.js. Supported sources consistently describe a stored XSS ...