CWE-830 · 11 records
Inclusion of Web Functionality from an Untrusted Source
CVEs in this class
11 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
35Monitor | CVE-2023-2588No exploit | Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (teltonika · remote management system · CWE-830 | High8.8 | — | 1.1% | May 22, 2023 |
34Monitor | CVE-2024-29944No exploit | An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent procemozilla · firefox · CWE-830 | High8.4 | — | 4.7% | Mar 22, 2024 |
34Monitor | CVE-2025-65109No exploit | Minder does not sandbox http.send in Rego programsmindersec · minder · CWE-830 | High8.5 | — | 0.3% | Nov 21, 2025 |
33Monitor | CVE-2024-42381No exploit | os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieveCWE-830 | High8.3 | — | 0.6% | Jul 31, 2024 |
31Monitor | CVE-2025-33026No exploit | In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability.peazip · peazip · CWE-830 | High7.8 | — | 0.3% | Apr 15, 2025 |
31Monitor | CVE-2025-33027No exploit | In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability.bandisoft · bandizip · CWE-830 | High7.8 | — | 0.3% | Apr 15, 2025 |
24Monitor | CVE-2021-28162No exploit | In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.eclipse · theia · CWE-830 | Medium6.1 | — | 0.8% | Mar 12, 2021 |
24Monitor | CVE-2025-33028No exploit | In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.winzip · winzip · CWE-830 | Medium6.1 | — | 0.5% | Apr 15, 2025 |
24Monitor | CVE-2025-46652No exploit | In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability.izarc · izarc · CWE-830 | Medium6.1 | — | 0.3% | Apr 26, 2025 |
24Monitor | CVE-2024-35180No exploit | OMERO.web JSONP callback vulnerabilityopenmicroscopy · omero-web · CWE-830 | Medium6.1 | — | 0.3% | May 21, 2024 |
21Monitor | CVE-2025-43703No exploit | An issue was discovered in Ankitects Anki through 25.02.ankitects · anki · CWE-830 | Medium5.4 | — | 0.2% | Apr 16, 2025 |
- CVE-2023-258835Monitor
Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (
HighCVSS 8.8No exploitEPSS 1%teltonika · remote management systemMay 22, 2023
- CVE-2024-2994434Monitor
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent proce
HighCVSS 8.4No exploitEPSS 5%mozilla · firefoxMar 22, 2024
- CVE-2025-6510934Monitor
Minder does not sandbox http.send in Rego programs
HighCVSS 8.5No exploitEPSS 0%mindersec · minderNov 21, 2025
- CVE-2024-4238133Monitor
os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve
HighCVSS 8.3No exploitEPSS 1%Jul 31, 2024
- CVE-2025-3302631Monitor
In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability.
HighCVSS 7.8No exploitEPSS 0%peazip · peazipApr 15, 2025
- CVE-2025-3302731Monitor
In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability.
HighCVSS 7.8No exploitEPSS 0%bandisoft · bandizipApr 15, 2025
- CVE-2021-2816224Monitor
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
MediumCVSS 6.1No exploitEPSS 1%eclipse · theiaMar 12, 2021
- CVE-2025-3302824Monitor
In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.
MediumCVSS 6.1No exploitEPSS 1%winzip · winzipApr 15, 2025
- CVE-2025-4665224Monitor
In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability.
MediumCVSS 6.1No exploitEPSS 0%izarc · izarcApr 26, 2025
- CVE-2024-3518024Monitor
OMERO.web JSONP callback vulnerability
MediumCVSS 6.1No exploitEPSS 0%openmicroscopy · omero-webMay 21, 2024
- CVE-2025-4370321Monitor
An issue was discovered in Ankitects Anki through 25.02.
MediumCVSS 5.4No exploitEPSS 0%ankitects · ankiApr 16, 2025