Ecosystem
NuGet
1,172 known vulnerabilities.
Most affected packages
23 results · Clear filters · Feed
-
Medium 5.9CVE-2026-44788 Public exploit
SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)
SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction …
-
Medium 5.3CVE-2025-24011 Public exploit
Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management …
-
Medium 6.1CVE-2022-31160 Public exploit
jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…
-
Medium 6.5
XSS in the `of` option of the `.position()` util
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value pass…
-
Medium 6.5
XSS in the `altField` option of the Datepicker widget
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value…
-
Medium 6.5CVE-2020-5811 Public exploit
Authenticated path traversal in Umbraco CMS
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
-
Medium —CVE-2020-28042 Public exploit
Signature validation bypass in ServiceStack
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
-
Medium 6.1CVE-2020-7656 Public exploit
Cross-Site Scripting in jquery
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
-
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
Medium 6.9
jQuery has a potential XSS vulnerability
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…
-
Medium 6.1CVE-2019-12562 Public exploit
Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing conten…
-
Medium 6.1
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…
-
Medium 5.3
CoreFTP Directory Traversal
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned informatio…
-
Medium 6.1
Bootstrap Vulnerable to Cross-Site Scripting
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
-
Medium 6.1CVE-2016-10735 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
-
Medium 6.1CVE-2018-14042 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
-
Medium 6.1CVE-2018-14041 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
-
Medium 6.1CVE-2018-14040 Public exploit
Bootstrap vulnerable to Cross-Site Scripting (XSS)
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
-
Medium 6.1
Cross-Site Scripting (XSS) in jquery
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
-
Medium 6.1CVE-2012-6708 Public exploit
Cross-Site Scripting in jquery
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…
-
Medium —CVE-2017-0248 Public exploit
Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."
-
Medium —CVE-2009-4665 Public exploit
CuteSoft CuteEditor Path Traversal vulnerability
Directory traversal vulnerability in CuteSoft_Client/CuteEditor/Load.ashx in CuteSoft Components Cute Editor for ASP.NET allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
-
Medium —CVE-2008-6540 Public exploit
DotNetNuke Default Machine Key Exposure
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restric…