Orejime is a consent manager that focuses on accessibility. On HTML elements handled by Orejime prior to version 2.3.2, one could run malicious code by embedding `javascript:` code within data attributes. When consenting to the related purpose, Orejime would turn data attributes into unprefixed ones (i.e. `data-href` into `href`), thus executing the code. This shouldn't have any impact on most setups, as elements handled by Orejime are generally hardcoded. The problem would only arise if somebody could inject HTML code within pages. The problem has been patched in version 2.3.2. As a workaround, the problem can be fixed outside of Orejime by sanitizing attributes which could contain executable code.
CVE-2025-14266 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Ercom Cryptobox administration console versions 4.0.0 through 4.38.0. An attacker can exploit this flaw by tricking an authenticated administrator into visiting a malicious website or clicking a crafted link, causing unintended administrative actions to be executed without the administrator's consent. The vulnerability requires the administrator to have an active session and involves no privilege requirements or direct authentication bypass. Although the CVSS score is low (0.6), the risk lies in the potential unauthorized execution of administrative commands that could affect system integrity or availability. No known exploits are currently in the wild, and no patches have been published yet.
An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle
By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges
In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions
This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.
CVE-2025-13119 is a medium-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Fabian Ros Simple E-Banking System version 1.0. The flaw allows remote attackers to trick authenticated users into executing unwanted actions without their consent, potentially altering banking operations. Exploitation requires user interaction but no authentication or privileges beyond those of the victim. Although no known exploits are currently in the wild, a proof-of-concept has been published, increasing the risk of future attacks. The vulnerability impacts the integrity and potentially the availability of banking transactions but does not directly compromise confidentiality. European organizations using this e-banking system should prioritize mitigation to prevent unauthorized transaction manipulation. Countries with higher adoption of this software or significant banking sectors are at greater risk. Immediate mitigation includes implementing anti-CSRF tokens, validating request origins, and educating users about phishing risks. Given the medium CVSS score of 5.
The npm package frontend-vue-next versions 1.0.0 and 1.2.0 contains malicious code that executes automatically during installation. The package runs a script that collects detailed system and user identity information and sends it to an attacker-controlled server. This behavior leaks sensitive host and user data without consent, posing a privacy and security risk to developers and CI environments.
The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-20701 is an incorrect authorization vulnerability in the Airoha Bluetooth audio SDK affecting AB156x, AB157x, AB158x, and AB159x series. It allows pairing of Bluetooth audio devices without user consent, enabling remote escalation of privilege without requiring user interaction or additional execution privileges. The vulnerability has a high severity score of 8.8.
The hyperion-react-native-testapp npm package contains malicious code that executes a preinstall script during npm install. This script sends the installer's username, current directory, and hostname to a third-party webhook URL without user consent. This behavior constitutes unauthorized data exfiltration and is consistent with dependency confusion proof-of-concept techniques, though the exfiltration itself is real regardless of intent.
Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the application with altered dynamic library successfully bypassing Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.
This issue affects DaVinci Resolve on macOS in all versions.
Last tested version: 19.1.3
The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website. Thus, this allows malicious actions to be executed without user consent.
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes parameter of the Cookie Consent Widget in all versions up to, and including, 5.10.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The npm package 'sn-flow-client' versions 10.10.10, 20.5.1, and 1.0.2 contain malicious code that executes automatically upon installation. This code collects detailed host and user identity information and sends it to an attacker-controlled external domain without user consent. The package lacks legitimate functionality and appears designed for dependency confusion attacks or reconnaissance.
The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without their consent, potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exploited to perform a stored cross-site scripting (XSS) attack, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 9.3.
In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent due to improper input validation. This could lead to local escalation of privilege during app installation or upgrade with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-213323615