Threats Tagged 'cwe-84'

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

CVE-2025-58444 is a high-severity cross-site scripting (XSS) vulnerability in the modelcontextprotocol (MCP) Inspector local development tool. The flaw occurs when the Inspector renders a redirect URL from a remote MCP server without proper neutralization of encoded URI schemes. Connecting to an untrusted server can allow crafted redirects to inject scripts into the Inspector context, potentially leading to arbitrary command execution on the developer's machine. Version 0.16.6 of the Inspector includes hardened URL handling and validation that prevents this script execution.

HighVulnerabilityGermanyFranceNetherlands+4#cve#cve-2025-58444#cwe-84

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.