Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

88 results · page 2 of 2

Jun 4, 2025Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to byCVE-2025-2336 · Computers, phones & browsers · Google · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.8
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects AngularJS versions greater than or equal to 1.3.1. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Product
AngularJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codepen.io herodevs.com
Apr 29, 2025Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image sourCVE-2025-0716 · Computers, phones & browsers · Google · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.8
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Product
AngularJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codepen.io herodevs.com
Feb 14, 2025Advanced Angular Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23658 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angular-contact-form allows Reflected XSS.This issue affects Advanced Angular Contact Form: from n/a through <= 1.1.0.
Product
Advanced Angular Contact Form
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Advanced Angular Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 10, 2024Angular Expressions provides expressions for the Angular.JS web framework as a standalone module.CVE-2024-54152 · Other software · peerigon · reported by GitHubCritical 9.3
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. The problem has been patched in version 1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to `__proto__` globally or make sure that one uses the function with just one argument.
Product
angular-expressions
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settingsCVE-2024-50577 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings
Product
YouTrack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Oct 24, 2024A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and suCVE-2024-48145 · Other software · netangular · reported by MITRECritical 9.1
A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
Product
chatnet_ai
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record apps.microsoft.com github.com
Oct 11, 2024angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php.CVE-2024-42640 · Other software · angular-base64-upload-project · reported by MITRECritical 9.8
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Product
angular-base64-upload
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com zyenra.com
Sep 9, 2024Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions,CVE-2024-8373 · Computers, phones & browsers · Google · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.8
Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Product
AngularJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codepen.io herodevs.com
Sep 9, 2024Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a CVE-2024-8372 · Computers, phones & browsers · Google · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.8
Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Product
AngularJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codepen.io herodevs.com
Apr 25, 2024angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive.CVE-2024-33665 · Other software · reported by MITREMedium 6.1
angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor indicates that there is no documentation indicating that a key is supposed to be safe against XSS attacks.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.herodevs.com github.com
Feb 10, 2024This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.CVE-2024-21490 · Other software · Angularjs · reported by report@snyk.ioHigh 7.5
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
Product
Angular.js
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.snyk.io security.snyk.io
Jun 30, 2023angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2023-34840 · Other software · Angular-ui-notification Project · reported by MITREMedium 6.1
angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.
Product
Angular-ui-notification
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 3, 2023Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0.CVE-2022-27665 · Other software · Progress · reported by MITREMedium 6.1
Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI.
Product
WS FTP Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com docs.ipswitch.com
Mar 30, 2023Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage ofCVE-2023-26118 · Other software · Angularjs · reported by report@snyk.ioMedium 5.3
Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Product
Angularjs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 30, 2023Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecCVE-2023-26117 · Other software · Angularjs · reported by report@snyk.ioMedium 5.3
Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Product
Angularjs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 30, 2023Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usCVE-2023-26116 · Other software · Angularjs · reported by report@snyk.ioMedium 5.3
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Product
Angularjs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Mar 24, 2023angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables.CVE-2023-28444 · Other software · kyubisation · reported by GitHubCritical 9.9
angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file). With version 15.0.0 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html. This has NO IMPACT, in a plain Angular project that has no backend component. This vulnerability has been mitigated in version 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default. As a workaround, manually edit or create ngssc.json or run script after ngssc.j
Product
angular-server-side-configuration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 21, 2023textAngular is a text editor for Angular.js.CVE-2021-32854 · Other software · npm · reported by GitHubMedium 6.1
textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches.
Product
textangular
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitylab.github.com securitylab.github.com
Jan 9, 2023A vulnerability was found in gperson angular-test-reporter and classified as critical.CVE-2015-10035 · Other software · gperson · reported by VulDBMedium 5.5
A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function getProjectTables/addTest of the file rest-server/data-server.js. The manipulation leads to sql injection. The patch is named a29d8ae121b46ebfa96a55a9106466ab2ef166ae. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217715.
Product
angular-test-reporter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Jul 15, 2022All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XCVE-2022-25869 · Other software · Angularjs · reported by report@snyk.ioMedium 4.2
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
Product
Angularjs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record neverendingsupport.github.io security.snyk.io
May 26, 2022A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2.CVE-2021-4231 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.
Product
Angular
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 1, 2022The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assigCVE-2022-25844 · Other software · Angularjs · reported by report@snyk.ioMedium 5.3
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.
Product
Angularjs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
May 14, 2021ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service.CVE-2021-32816 · Other software · ProtonMail · reported by GitHubMedium 6.5
ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular expression denial-of-service vulnerability. This was fixed in commit 6687fb. There is a full report available in the referenced GHSL-2021-027.
Product
WebClient
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com securitylab.github.com
Feb 1, 2021angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node".CVE-2021-21277 · Other software · peerigon · reported by GitHubHigh 8.5
angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compile(userControlledInput)" where "userControlledInput" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a ".constructor.constructor" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.
Product
angular-expressions
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.angularjs.org github.com
Jun 8, 2020angular.js prior to 1.8.0 allows cross site scripting.CVE-2020-7676 · Other software · Angularjs · reported by report@snyk.ioMedium 5.4
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
Product
Angularjs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Mar 10, 2020The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-ScripCVE-2020-6200 · Websites & servers · SAP SE · reported by cna@sap.comMedium 5.4
The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that exploits the templating facilities of the angular framework.
Product
SAP Commerce Cloud (SmartEdit Extension)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Jan 24, 2020Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInpuCVE-2020-5219 · Other software · peerigon · reported by GitHubHigh 8.7
Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.
Product
angular-expressions
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.angularjs.org github.com
Jan 17, 2020A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms.CVE-2019-17127 · Other software · Solarwinds · reported by MITREMedium 6.1
A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation.
Product
Orion Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com support.solarwinds.com
Jan 17, 2020A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms.CVE-2019-17125 · Other software · Solarwinds · reported by MITREMedium 6.1
A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS.
Product
Orion Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com support.solarwinds.com
Jan 2, 2020There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers dataCVE-2019-14863 · Other software · Red Hat · reported by Red HatMedium 6.1
There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
Product
angular:
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com snyk.io
Nov 19, 2019In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.CVE-2019-10768 · Other software · Angularjs · reported by report@snyk.ioHigh 7.5
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
Product
Angularjs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org snyk.io
Jul 5, 2018Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a rCVE-2018-13339 · Other software · Angular Redactor Project · reported by MITREMedium 6.1
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.
Product
Angular Redactor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2018Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvCVE-2018-11537 · Other software · Auth0 · reported by MITREMedium 6.5
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
Product
Angular-jwt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record auth0.com auth0.com
Jun 6, 2018angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to readCVE-2018-3713 · Other software · HackerOne · reported by support@hackerone.comMedium 6.5
angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to read content of any file with known path.
Product
angular-http-server node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com hackerone.com
May 31, 2018i18n-node-angular is a module used to interact between i18n and angular without using additional resources.CVE-2016-10524 · Other software · HackerOne · reported by support@hackerone.comHigh 8.2
i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection.
Product
i18n-node-angular node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nodesecurity.io
Aug 7, 2017IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtaCVE-2017-12677 · Other software · Identityserver · reported by MITREMedium 6.1
IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.
Product
Identityserver3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 18, 2017Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field.CVE-2017-5246 · Other software · Biscom · reported by cve@rapid7.comMedium 4.3
Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces ({{ }}). This expression will be evaluated by any other authenticated user who views the attacker's display name. Affected versions are 5.0.0000 through 5.1.1026. The Issue is fixed in 5.1.1028.
Product
Secure File Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.biscom.com twitter.com
Feb 20, 2015Cross-site scripting (XSS) vulnerability in textAngular-sanitize.js in textAngular before 1.3.7 allows remote attackers to inject arbitrary web script or HTML vCVE-2015-0167 · Other software · Textangular · reported by psirt@us.ibm.comMedium 4.3
Cross-site scripting (XSS) vulnerability in textAngular-sanitize.js in textAngular before 1.3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the editor.
Product
Textangular
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.