Snyk Security Database

@haxtheweb/haxcms-nodejs is a HAXcms nodejs backend

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the processing of uploaded .html files. An attacker can execute arbitrary JavaScript in the context of another user's session by uploading .html files containing a JavaScript payload. Subsequently, the attacker can obtain a valid administrator JWT and can take full control of the application

nicegui is a Create web-based user interfaces with Python. The nice way.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the pushstate event listener, which allows manipulation of the URL fragment identifier. An attacker can execute arbitrary JavaScript in the context of the affected application by embedding the target site in an iframe and altering the fragment portion of the URL.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the getTemplate function. An attacker can execute arbitrary code on the server by injecting malicious FreeMarker templates through the email template editing API when authenticated with administrative privileges.

Note: This is only exploitable if the attacker has access to an account with admin-level permissions.