Jquery
Monthly
BuilderEngine 3.5.0 contains a critical unrestricted file upload vulnerability in its elFinder 2.0 integration and jQuery File Upload plugin, allowing unauthenticated attackers to upload and execute arbitrary PHP files on the server, resulting in complete remote code execution (RCE) under the web server process context. The vulnerability is characterized by a CVSS 9.3 score with no authentication or user interaction required, making it immediately exploitable across network boundaries.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting (DOM/stored) in Progress Kendo UI for jQuery prior to v2026.3.1015 allows an attacker who can influence Menu dataSource fields to inject JavaScript event-handler attributes that execute in a victim's browser when the affected Menu is interacted with. The flaw requires low privileges (PR:L) to write the attacker-controlled bound fields and user interaction (UI:R) to trigger execution, with a scope change (S:C) since the injected script runs in the host application's page context, affecting confidentiality and integrity of browser-accessible data. Progress has released a vendor patch in v2026.3.1015; no confirmed active exploitation or public exploit code was identified at time of analysis, and the issue is assessed as moderate severity rather than a mass-exploitation threat.
Cross-site scripting in the FileManager component of Progress Kendo UI for jQuery (versions 2023.3.1010 through 2026.3.1015) allows an attacker who can control or influence a file or folder name to inject HTML with event handlers that execute JavaScript in a victim's browser when the user drags that item, because the default drag hint renders the remote item name as raw HTML while the corresponding list items are correctly encoded. The vector is unauthenticated over the network (PR:N) but requires a user to actively drag the poisoned item and demands the attacker first seed a crafted name, so the CVSS 4.7 (Medium) score reflects a genuinely moderate priority - no public exploit code exists and there is no evidence of active exploitation. The issue is a client-side DOM XSS with scoped confidentiality and integrity impact (S:C/C:L/I:L/A:N) and is fixed in version 2026.3.1015.
Stored HTML injection in Pi-hole Admin Interface versions 6.0+ allows authenticated attackers to inject arbitrary HTML into the active sessions table via the X-Forwarded-For header, which is unsafely rendered when administrators view the API settings page. Public exploit code exists for this vulnerability, affecting administrators who manage Pi-hole instances. An attacker with valid credentials can exploit this to perform client-side attacks against other administrators viewing the compromised session data.
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
BuilderEngine 3.5.0 contains a critical unrestricted file upload vulnerability in its elFinder 2.0 integration and jQuery File Upload plugin, allowing unauthenticated attackers to upload and execute arbitrary PHP files on the server, resulting in complete remote code execution (RCE) under the web server process context. The vulnerability is characterized by a CVSS 9.3 score with no authentication or user interaction required, making it immediately exploitable across network boundaries.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting (DOM/stored) in Progress Kendo UI for jQuery prior to v2026.3.1015 allows an attacker who can influence Menu dataSource fields to inject JavaScript event-handler attributes that execute in a victim's browser when the affected Menu is interacted with. The flaw requires low privileges (PR:L) to write the attacker-controlled bound fields and user interaction (UI:R) to trigger execution, with a scope change (S:C) since the injected script runs in the host application's page context, affecting confidentiality and integrity of browser-accessible data. Progress has released a vendor patch in v2026.3.1015; no confirmed active exploitation or public exploit code was identified at time of analysis, and the issue is assessed as moderate severity rather than a mass-exploitation threat.
Cross-site scripting in the FileManager component of Progress Kendo UI for jQuery (versions 2023.3.1010 through 2026.3.1015) allows an attacker who can control or influence a file or folder name to inject HTML with event handlers that execute JavaScript in a victim's browser when the user drags that item, because the default drag hint renders the remote item name as raw HTML while the corresponding list items are correctly encoded. The vector is unauthenticated over the network (PR:N) but requires a user to actively drag the poisoned item and demands the attacker first seed a crafted name, so the CVSS 4.7 (Medium) score reflects a genuinely moderate priority - no public exploit code exists and there is no evidence of active exploitation. The issue is a client-side DOM XSS with scoped confidentiality and integrity impact (S:C/C:L/I:L/A:N) and is fixed in version 2026.3.1015.
Stored HTML injection in Pi-hole Admin Interface versions 6.0+ allows authenticated attackers to inject arbitrary HTML into the active sessions table via the X-Forwarded-For header, which is unsafely rendered when administrators view the API settings page. Public exploit code exists for this vulnerability, affecting administrators who manage Pi-hole instances. An attacker with valid credentials can exploit this to perform client-side attacks against other administrators viewing the compromised session data.
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.