materializecss @materializecss/materialize vulnerabilities

Latest materializecss @materializecss/materialize CVEs

Newest publication first

1. CVE-2022-25349 Cross-site Scripting (XSS)

   Published 2022-05-01

   Medium·CVSS 5.4 EPSS 1.0%

   All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when t...

2. CVE-2019-11004 Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation

   Published 2019-04-08

   Medium·CVSS 6.1 EPSS 0.79%

   In Materialize through 1.0.0, XSS is possible via the Toast feature.

3. CVE-2019-11003 Materialize-css vulnerable to Cross-site Scripting in autocomplete component

   Published 2019-04-08

   Medium·CVSS 6.1 EPSS 0.79%

   In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.

4. CVE-2019-11002 Materialize-css vulnerable to Cross-site Scripting in tooltip component

   Published 2019-04-08

   Medium·CVSS 6.1 EPSS 0.80%

   In Materialize through 1.0.0, XSS is possible via the Tooltip feature.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.