Vitess users with backup storage access can gain unauthorized access to production deployment environments

vitessio vitess vitessio vitess +1个

Koa has Host Header Injection via `ctx.hostname`

koajs koa koajs koa +1个

LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints

LiveHelperChat livehelperchat livehelperchat live_helper_chat

Agenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCE

Agenta-AI agenta agentatech agenta

Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)

Agenta-AI agenta-api agentatech agenta

Copyparty vulnerable to eflected cross-site scripting via setck parameter

9001 copyparty 9001 copyparty

OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership

openemr openemr open-emr openemr

Custom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting

tgrk Custom Logo

Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes

livemesh Livemesh Addons for Beaver Builder

TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea

readymadeweb TP2WP Importer

WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings

bulktheme WP Social Meta

WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src

stuartbates WP Responsive Images

EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'

motahar1 EM Cost Calculator

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

NaturalIntelligence fast-xml-parser fast-xml-parser_project fast-xml-parser +1个

OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

openlit openlit

WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow

wp-graphql wp-graphql

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

isaacs minimatch isaacs minimatch +7个

minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

isaacs minimatch isaacs minimatch +7个

Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

sveltejs svelte

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

sveltejs svelte