Ecosystem
npm
7,717 known vulnerabilities.
Most affected packages
2,771 results · Clear filters · Feed
-
Medium 6.1
Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation
In Materialize through 1.0.0, XSS is possible via the Toast feature.
-
Medium 6.1
Materialize-css vulnerable to Cross-site Scripting in autocomplete component
In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.
-
Medium 6.1
Materialize-css vulnerable to Cross-site Scripting in tooltip component
In Materialize through 1.0.0, XSS is possible via the Tooltip feature.
-
Medium 6.1
Moderate severity vulnerability that affects total.js
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation in Select2
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
-
Medium 6.1
Cross-Site Scripting in simple-markdown
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.
-
Medium 6.1
Cross-Site Scripting in editor.md
Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.
-
Medium 6.1
Bootstrap Vulnerable to Cross-Site Scripting
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
-
Medium 5.3
uap-core Regular Expression Denial of Service issue
An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value co…
-
Medium —CVE-2018-16492 Public exploit
Prototype Pollution in extend
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
-
Medium 6.1
Tnantoka/public XSS Vulnerability
A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering.
-
Medium 6.5
m-server Vulnerable to Directory Traversal
Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.
-
Medium 6.1
Cross-Site Scripting in html-pages
A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering.
-
Medium 5.4
Cross-Site Scripting in m-server
A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.
-
Medium 6.1
XSS vulnerability that affects bootstrap
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
-
Medium 6.1
bootstrap Cross-site Scripting vulnerability
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
-
Medium 6.1CVE-2016-10735 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
-
Medium 6.1CVE-2018-6341 Public exploit
Cross-Site Scripting in react-dom
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x,…
-
Medium 6.1
rendertron XSS vulnerability
Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.
-
Medium 5.3
Path Traversal in simplehttpserver
A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.
-
Medium 6.1
Valine HTML Injection
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
-
Medium 6.1
Ckeditor XSS Vulnerability
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
-
Medium 6.1
SimpleMDE XSS Vulnerability
SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
-
Medium 6.1
Pandao editor.md vulnerable to DOM XSS
pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.
-
Medium 5.3
Path Traversal in takeapeek
A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.
-
Medium 6.1
Stored Cross-Site Scripting in tianma-static
A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.
-
Medium —
Command Injection in libnmap
A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options.
-
Medium 6.1
Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.
-
Medium 5.4
Cross-site Scripting in yapi-vendor
An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
-
Medium 5.5
Open Chinese Convert subject to Denial of Service via Out-of-bounds Read
Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.
-
Medium 6.1
Cross-Site Scripting in exceljs
An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.
-
Medium 5.3
ReDoS via long string of semicolons in tough-cookie
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability …
-
Medium 6.1
Pandao editor.md vulnerable to XSS in IMG attributes
Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
-
Medium 5.3
Improper Authorization in aedes
Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.
-
Medium 6.1
metascraper before v5.2.0 vulnerable to stored cross-site scripting
There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.
-
Medium 5.5CVE-2018-1002203 EPSS 11%
Arbitrary File Write via Archive Extraction in unzipper
unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.5CVE-2018-1002204 EPSS 13%
Arbitrary File Write in adm-zip
adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Medium 5.4
Macro in MathJax running untrusted Javascript within a web browser
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view …
-
Medium 5.5
Remote Code Execution in markdown-pdf
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
-
Medium 6.1
statics-server Cross-site Scripting vulnerability
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.