Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
240 results · page 3 of 5
Sep 5, 2025Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacCVE-2025-9999 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932High 7.6
Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacker to execute unauthorized commands in the application.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025The sequence of packets received by a Networking server are not correctly checked.CVE-2025-9998 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 6
The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit this vulnerability to send specially crafted messages to force the application to stop.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component.CVE-2025-54075 · Other software · nuxt-modules · reported by GitHubHigh 8.3
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a `<base href="https://attacker.tld">` element. The `<base>` tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context. Version 0.17.2 contains a fix for the issue.
- Product
- mdc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Vue I18n is the internationalization plugin for Vue.js.CVE-2025-53892 · Other software · intlify · reported by GitHubMedium 5.3
Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.
- Product
- vue-i18n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2025A vulnerability was found in BlackVue Dashcam 590X up to 20250624.CVE-2025-7076 · Other software · BlackVue · reported by VulDBLow 2.1
A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.cgi of the component Configuration Handler. The manipulation leads to improper access controls. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dashcam 590X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2025A vulnerability was found in BlackVue Dashcam 590X up to 20250624.CVE-2025-7075 · Other software · BlackVue · reported by VulDBLow 2.1
A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /upload.cgi of the component HTTP Endpoint. The manipulation leads to unrestricted upload. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dashcam 590X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical.CVE-2025-6925 · Other software · Dromara · reported by VulDBMedium 5.5
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RuoYi-Vue-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2025A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410.CVE-2025-6099 · Other software · szluyu99 · reported by VulDBMedium 5.5
A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects unknown code of the file gin-blog-server/internal/manager.go of the component PATCH Request Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- gin-vue-blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability was found in vuejs vue-cli up to 5.0.8.CVE-2025-5897 · Other software · vuejs · reported by VulDBMedium 5.3
A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely.
- Product
- vue-cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the pagCVE-2025-1461 · Other software · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 5.6
Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss attack. The vulnerability occurs because the default Vuetify translator will return the translation key as the translation, if it can't find an actual translation. This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0. Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comherodevs.com
May 19, 2025Bellevue: Missing AuthorizationCVE-2025-39398 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2.
- Product
- Bellevue
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update Bellevue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 11, 2025A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic.CVE-2025-4537 · Other software · yangzongzhuan · reported by VulDBLow 2.3
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive information in a cookie. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- RuoYi-Vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
May 6, 2025The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid.CVE-2025-4384 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 6
The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025A vulnerability, which was classified as problematic, has been found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0.CVE-2025-3850 · Other software · YXJ2018 · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, has been found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This issue affects some unknown processing of the component API. The manipulation leads to improper authentication. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- SpringBoot-Vue-OnlineExam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0.CVE-2025-3849 · Other software · YXJ2018 · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentPWD. The manipulation of the argument studentId leads to unverified password change. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- SpringBoot-Vue-OnlineExam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Shopware 6 is an open commerce platform based on Symfony Framework and Vue.CVE-2025-30150 · Other software · shopware · reported by GitHubMedium 5.5
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found. This vulnerability is fixed in Shopware 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file.CVE-2024-55028 · Other software · Nasa · reported by MITRECritical 9.8
A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file.
- Product
- Fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvisionspace.comvisionspace.com
Mar 25, 2025A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1.CVE-2025-2744 · Other software · zhijiantianya · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1.CVE-2025-2743 · Other software · zhijiantianya · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1.CVE-2025-2742 · Other software · zhijiantianya · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1.CVE-2025-2708 · Other software · zhijiantianya · reported by VulDBLow 2.1
A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1.CVE-2025-2707 · Other software · zhijiantianya · reported by VulDBLow 2.1
A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025Nuxt is an open-source web development framework for Vue.js.CVE-2025-27415 · Other software · nuxt · reported by GitHubHigh 7.5
Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2025A vulnerability was found in BlackVue App 3.65 on Android.CVE-2025-2356 · Other software · BlackVue · reported by VulDBMedium 6.3
A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2025A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic.CVE-2025-2355 · Other software · BlackVue · reported by VulDBMedium 4.8
A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component API Endpoint Handler. The manipulation of the argument BCS_TOKEN/SECRET_KEY leads to unprotected storage of credentials. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025Vue I18n is the internationalization plugin for Vue.js.CVE-2025-27597 · Other software · intlify · reported by GitHubHigh 8.9
Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence. Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.
- Product
- vue-i18n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1.CVE-2025-2040 · Other software · zhijiantianya · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.CVE-2025-25570 · Other software · reported by MITRECritical 9.8
Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which caCVE-2024-11628 · Other software · Progress Software · reported by security@progress.comMedium 4.1
In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
- Product
- Progress® Telerik® Kendo UI for Vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component.CVE-2025-24981 · Other software · nuxt-modules · reported by GitHubCritical 9.3
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the `javascript:` protocol scheme in the URL. The parsing logic implement in `props.ts` maintains a deny-list approach to filtering potential malicious payload. It does so by matching protocol schemes like `javascript:` and others. These security guards can be bypassed by an adversarial that provides JavaScript URLs with HTML entities encoded via hex string. Users who consume this library and perform markdown parsing from unvalidated sources could result in rendering vulnerable XSS anchor links. This vulnerability has been addressed in version 0.13.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mdc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Nuxt is an open-source web development framework for Vue.js.CVE-2025-24361 · Other software · nuxt · reported by GitHubMedium 5.3
Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Nuxt is an open-source web development framework for Vue.js.CVE-2025-24360 · Other software · nuxt · reported by GitHubMedium 5.3
Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with thCVE-2024-12057 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Low 1.8
User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024The Client secret is not checked when using the OAuth Password grant type.CVE-2024-12056 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Low 2.3
The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024@intlify/shared is a shared library for the intlify project.CVE-2024-52810 · Other software · intlify · reported by GitHubMedium 6.9
@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) as the minimum consequence. Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- vue-i18n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024vue-i18n is an internationalization plugin for Vue.js.CVE-2024-52809 · Other software · intlify · reported by GitHubMedium 5.3
vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- vue-i18n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.CVE-2024-9506 · Other software · vue · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cLow 3.7
Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
- Product
- vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.CVE-2024-42352 · Other software · nuxt · reported by GitHubHigh 8.6
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client side icon lookup. This endpoint is at `/api/_nuxt_icon/[name]`. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure. The `new URL` constructor is used to parse the final path. This constructor can be passed a relative scheme or path in order to change the host the request is sent to. This constructor is also very tolerant of poorly formatted URLs. As a result we can pass a path prefixed with the string `http:`. This has the effect of changing the scheme to HTTP. We can then subsequently pass a new host, for example `http:127.0.0.1:8080`. This would allow us to send requests to a local server. This issue has been addressed in release version 1.4.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- icon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.CVE-2024-34344 · Other software · nuxt · reported by GitHubHigh 8.8
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands. Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page. Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.CVE-2024-34343 · Other software · nuxt · reported by GitHubMedium 6.3
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The `navigateTo` function attempts to blockthe `javascript:` protocol, but does not correctly use API's provided by `unjs/ufo`. This library also contains parsing discrepancies. The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns true for a javascript: protocol. After this, the URL is parsed using the parseURL function. This function will refuse to parse poorly formatted URLs. Parsing javascript:alert(1) returns null/"" for all values. Next, the protocol of the URL is then checked using the isScriptProtocol function. This function simply checks the input against a list of protocols, and does not perform any parsing. The combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the parseURL implementation, bypassing the isScriptProtocol checks. Certain special protocols are identified at the top of parseURL. Inser
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.CVE-2024-23657 · Other software · nuxt · reported by GitHubHigh 8.8
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability. In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE. The `getTextAssetContent` function does not check for path traversals, this could allow an attacker to read arbitrary files over the RPC WebSocket. The WebSocket server does not check the origin of the request leading to cross-site-websocket-hijacking. This may be intentional to allow certain configurations to work correctly. Nuxt Devtools authentication tokens are placed within the home directory of the current user. The malicious webpage can connect to the Devtools WebSocket, perform a directory traversal brute force to find the authentication token, then use the *authenticated* `writeStaticAssets` function to create a new Component, Nitro Han
- Product
- nuxt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2024A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution.CVE-2024-6783 · Other software · vue · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.8
A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to execute arbitrary JavaScript code.
- Product
- vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherodevs.comgithub.com
Jul 18, 2024The product does not require unique and complex passwords to be created during installation.CVE-2023-40704 · Other software · Philips · reported by ics-cert@hq.dhs.govMedium 5.7
The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.CVE-2024-23998 · Other software · goanother · reported by MITRECritical 9.6
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.
- Product
- another_redis_desktop_manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024Gin-vue-admin is a backstage management system based on vue and gin.CVE-2024-37896 · Other software · flipped-aurora · reported by GitHubHigh 8.8
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.6.5 has SQL injection vulnerability. The SQL injection vulnerabilities occur when a web application allows users to input data into SQL queries without sufficiently validating or sanitizing the input. Failing to properly enforce restrictions on user input could mean that even a basic form input field can be used to inject arbitrary and potentially dangerous SQL commands. This could lead to unauthorized access to the database, data leakage, data manipulation, or even complete compromise of the database server. This vulnerability has been addressed in commit `53d033821` which has been included in release version 2.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4.CVE-2024-5829 · Other software · smallweigit · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4. Affected by this vulnerability is an unknown functionality of the component avueUeditor. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267895. NOTE: The code maintainer explains, that "rich text is no longer maintained".
- Product
- Avue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component.CVE-2024-31760 · Other software · sanluan · reported by MITREMedium 4.7
An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component.
- Product
- flipped_aurora_gin_vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 9, 2024gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack.CVE-2024-31457 · Other software · flipped-aurora · reported by GitHubHigh 7.7
gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -> Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024Shopware 6 is an open commerce platform based on Symfony Framework and Vue.CVE-2024-31447 · Other software · shopware · reported by GitHubMedium 5.3
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Shopware is an open commerce platform based on Symfony Framework and Vue.CVE-2024-27917 · Other software · shopware · reported by GitHubHigh 7.5
Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used. Shopware version 6.5.8.7 contains a patch for this issue. As a workaround, use Redis for Sessions, as this does not trigger the exploit code.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.