/* Sprint 3 (25.09.): Light-Mode-Overrides der Seite-spezifischen Glass-/Tint-Tokens (die globalen --color-/-threat-Tokens schalten selbst um; nur die hier lokal definierten rgba-Tints brauchen explizite Light-Werte). Welle ML-16 (27.09.): PARSE-FIX — dieser Kommentar enthielt bis- her im Token-Doppelnamen die Zeichenfolge Stern+Slash und schloss sich damit VORZEITIG; der Rest wurde zu CSS-Muell und der Parser verschluckte die gesamte folgende Light-Regel. Der Block war seit Sprint 3 NIEMALS aktiv (die Light-Optik der Seite kam allein aus den globalen default.css-Tokens). */ html[data-bs-theme="light"] { --surface-glass: rgba(248, 250, 252, 0.92); --border-glass: rgba(15, 23, 42, 0.14); --surface-1: rgba(226, 232, 240, 0.45); --surface-2: rgba(226, 232, 240, 0.65); --surface-3: rgba(226, 232, 240, 0.6); --cyan-bg: rgba(8, 145, 178, 0.08); --cyan-bg-hover: rgba(8, 145, 178, 0.18); --cyan-border: rgba(8, 145, 178, 0.35); --cyan-border-strong: rgba(8, 145, 178, 0.45); --ring: 0 0 0 2px rgba(8, 145, 178, 0.45); --sev-critical-bg: rgba(220, 38, 38, 0.12); --sev-critical-bd: rgba(220, 38, 38, 0.35); --sev-high-bg: rgba(234, 88, 12, 0.12); --sev-high-bd: rgba(234, 88, 12, 0.35); --sev-medium-bg: rgba(202, 138, 4, 0.12); --sev-medium-bd: rgba(202, 138, 4, 0.35); --sev-low-bg: rgba(22, 163, 74, 0.12); --sev-low-bd: rgba(22, 163, 74, 0.35); /* Welle ML-16 (27.09.): Text-Tokens der Severity-Skala im Light — die Dark-300/400er (--threat-* bzw. #facc15-Familie) liegen auf #f8fafc bei 1.6-2.8:1 (R8-Walk, 15 Funde). 600/700er-Pendants, Projekt-Muster #b45309 (RCI-Heilung text-warning). */ --sev-critical: #b91c1c; --sev-critical-solid: #dc2626; --sev-high: #c2410c; --sev-high-solid: #ea580c; --sev-medium: #b45309; --sev-medium-solid: #d97706; --sev-low: #0369a1; --sev-low-solid: #0284c7; } body { background-color: var(--surface-ground, #0b0f19); color: var(--color-text-heading, #f8fafc); font-family: var(--font-sans); min-height: 100vh; } html[data-bs-theme="light"] body { color: var(--color-text-heading, #090d16); } /* Bootstrap-Mono-Kanal auf Marke umlenken (CVE-IDs, Scores, EPSS-Zahlen) */ body { --bs-font-monospace: var(--font-mono); } /* Kontrastanhebung im Seiten-Scope (betrifft ~25 extra-small-Texte) */ body .text-muted { color: var(--text-muted) !important; } /* Tastatur-Fokus: sichtbarer Cyan-Ring für alle Interaktiven */ a:focus-visible, button:focus-visible, [role="button"]:focus-visible, .filter-btn:focus-visible, .chip:focus-visible, .ms-option:focus-visible, input:focus-visible { outline: none; box-shadow: var(--ring); border-radius: var(--radius-pill); } .cve-card { background: var(--surface-glass); border: 1px solid var(--border-glass); border-radius: var(--radius-card); transition: transform 0.2s cubic-bezier(0.16, 1, 0.3, 1), border-color 0.2s ease, box-shadow 0.2s ease, backdrop-filter 0.2s ease; } .cve-card:hover, .cve-card.spotlight { backdrop-filter: blur(16px); /* Blur-Kosten nur bei Interesse, nicht dauerhaft auf 60 Karten */ } .cve-card:hover { transform: translateY(-3px); border-color: var(--cyan-border-strong); box-shadow: 0 10px 25px rgba(0, 240, 255, 0.08); } .cve-card.critical { border-left: 4px solid var(--sev-critical-solid); } .cve-card.high { border-left: 4px solid var(--sev-high-solid); } .cve-card.medium { border-left: 4px solid var(--sev-medium-solid); } .cve-card.low { border-left: 4px solid var(--sev-low-solid); } .cve-card.spotlight { border: 2px solid var(--cyan) !important; box-shadow: 0 0 35px rgba(0, 240, 255, 0.3) !important; } .badge-critical { background: var(--sev-critical-bg); color: var(--sev-critical); border: 1px solid var(--sev-critical-bd); font-weight: 700; } .badge-high { background: var(--sev-high-bg); color: var(--sev-high); border: 1px solid var(--sev-high-bd); font-weight: 700; } .badge-medium { background: var(--sev-medium-bg); color: var(--sev-medium); border: 1px solid var(--sev-medium-bd); font-weight: 700; } .badge-kev { background: #c03030; color: #fff; font-weight: 800; } /* WCAG 1.4.3: 5.67:1 — rgba(.9)-Rot war 4.46:1; LH1-W6: pulse entfernt — Opacity-Dip 0,55 blendete mitten im Puls auf #d88687/#fbf9fa (2,6:1, axe-Sampler) — gleiche Entscheidung wie §13 Flash-Banner */ /* Zeit- & Bedrohungs-Signale (10.10.2026): NEU-Badge, KEV-Alter, EPSS-Trendpfeil, aktualisiert-Fußnote. Bewusst OHNE Pulse/Animation (gleiche axe-Begründung wie badge-kev oben), fixe Kontrastfarben. */ .badge-new { background: #0891b2; color: #fff; font-weight: 800; letter-spacing: .05em; } /* Cyan-600 auf Karten-Panels */ .badge-kev .kev-age { color: rgba(255, 255, 255, .88); font-weight: 700; } .badge-kev .kev-fresh { color: #fde047; } /* frisch im KEV (≤ 7 T) — Gelb-Akzent im roten Badge, theme-unabhängig */ .epss-trend { font-size: .72rem; line-height: 1; font-weight: 800; } .epss-trend.up { color: #f87171; } /* steigende Exploit-Wahrscheinlichkeit = rot-warm */ .epss-trend.down { color: #4ade80; } /* sinkend = Grün */ .card-updated { opacity: .85; } /* --- Karten v2: Score-Typo + EPSS-Minibar + Icon-Signalleiste --- */ .card-score { font-family: var(--bs-font-monospace, ui-monospace, monospace); font-size: 1.35rem; font-weight: 800; line-height: 1; letter-spacing: -0.02em; } .card-score.critical { color: var(--sev-critical); } .card-score.high { color: var(--sev-high); } .card-score.medium { color: var(--sev-medium); } .card-score.low { color: var(--sev-low); } .epss-track { height: 4px; border-radius: 2px; background: rgba(148, 163, 184, 0.18); overflow: hidden; min-width: 5.5rem; } .epss-fill { height: 100%; border-radius: 2px; transition: width 0.6s cubic-bezier(0.16, 1, 0.3, 1); } .epss-fill.tier-danger { background: linear-gradient(90deg, #ef4444, #f87171); } .epss-fill.tier-warning { background: linear-gradient(90deg, #f59e0b, #fbbf24); } .epss-fill.tier-info { background: linear-gradient(90deg, #0ea5e9, #38bdf8); } .epss-fill.tier-muted { background: linear-gradient(90deg, #475569, #94a3b8); } .signal-chip { display: inline-flex; align-items: center; gap: 0.2rem; font-size: 0.68rem; font-weight: 700; letter-spacing: 0.02em; padding: 0.12rem 0.45rem; border-radius: var(--radius-pill); border: 1px solid var(--border-glass); background: var(--surface-1); } .filter-btn { background: rgba(30, 41, 59, 0.6); border: 1px solid var(--border-glass); color: var(--text-muted); font-size: 0.82rem; font-weight: 600; padding: 0.35rem 0.85rem; border-radius: 9999px; cursor: pointer; transition: all 0.2s ease; } .filter-btn:hover, .filter-btn.active { background: var(--cyan); color: var(--surface-ground, #0b0f19); border-color: var(--cyan); font-weight: 700; } .vendor-stat-tile { background: rgba(30, 41, 59, 0.4); border: 1px solid var(--border-glass); border-radius: 0.75rem; padding: 0.6rem 0.9rem; cursor: pointer; transition: all 0.2s ease; } .vendor-stat-tile:hover { border-color: rgba(0, 240, 255, 0.5); background: rgba(30, 41, 59, 0.8); transform: translateY(-2px); } /* --- Nachgelieferte Utilities: im Markup referenziert, aber in keinem der geladenen Stylesheets definiert --- */ .extra-small { font-size: 0.72rem; } /* R6-B1 (18.09.): statische Inline-Style-Muster aus dem Karten-Loop (×60 pro Render) auf Utilities — A3b-Vertrag auch auf Standalone- Routen. Dynamische Werte (Balken-width-%) bleiben inline. */ .extra-small-xs { font-size: 0.68rem; } .text-uppercase-track { text-transform: uppercase; letter-spacing: 0.04em; } .measure-card { max-width: var(--measure-card, 65ch); } .text-critical-rose { color: #fb7185; } .btn-inherit { background: transparent; border: none; color: inherit; font: inherit; text-align: left; cursor: pointer; } .text-cyan { color: var(--cyan); } .bg-cyan { background-color: var(--cyan); } .border-cyan { border-color: var(--cyan); } a.hover-cyan:hover, .hover-cyan:hover { color: var(--cyan); } .btn-xs { padding: 0.2rem 0.6rem; font-size: 0.72rem; } .text-truncate-3 { display: -webkit-box; -webkit-line-clamp: 3; -webkit-box-orient: vertical; overflow: hidden; } .tracking-wider { letter-spacing: 0.05em; } .leading-snug { line-height: 1.375; } .cursor-pointer { cursor: pointer; } .p-3\.5 { padding: 0.875rem; } .mb-1\.5 { margin-bottom: 0.375rem; } .mb-2\.5 { margin-bottom: 0.625rem; } .mt-2\.5 { margin-top: 0.625rem; } .px-1\.5 { padding-left: 0.375rem; padding-right: 0.375rem; } .px-2\.5 { padding-left: 0.625rem; padding-right: 0.625rem; } .py-0\.5 { padding-top: 0.125rem; padding-bottom: 0.125rem; } .py-1\.5 { padding-top: 0.375rem; padding-bottom: 0.375rem; } .gap-1\.5 { gap: 0.375rem; } @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.55; } } .animate-pulse { animation: pulse 2s infinite; } @keyframes fade-in-up { from { opacity: 0; transform: translateY(6px); } to { opacity: 1; transform: none; } } .animate-fade-in { animation: fade-in-up 0.4s ease-out; } /* --- EUVD-Quelle & Exploit-Status Badges (gleiche Optik wie .badge-critical etc.) --- */ .badge-euvd { background: rgba(0, 240, 255, 0.15); color: #22d3ee; border: 1px solid rgba(0, 240, 255, 0.4); font-weight: 700; } /* W21 (3. Rev, fixe Messung): Badge-Tint liegt auf DUNKLEN Panels (≈ #0d3244) — Original-Cyan trägt 6.6:1; die 1.39-Messung war ein Sampler-Alpha-Artefakt. Zurückgesetzt. */ .badge-exploited { background: var(--sev-critical-bg, rgba(239, 68, 68, 0.25)); color: var(--sev-critical); border: 1px solid rgba(239, 68, 68, 0.5); font-weight: 700; } .badge-poc { background: transparent; color: #fb7185; border: 1px dashed rgba(251, 113, 133, 0.55); font-weight: 600; } .cve-card.low { border-left: 4px solid #38bdf8; } .badge-low { background: rgba(56, 189, 248, 0.2); color: #7dd3fc; border: 1px solid rgba(56, 189, 248, 0.4); font-weight: 700; } /* --- CVE-Dossier (?cve=-Detailansicht) --- */ .dossier-rejected { background: rgba(245, 158, 11, 0.12); border: 1px solid rgba(245, 158, 11, 0.45); } .metric-tile { background: rgba(30, 41, 59, 0.55); border: 1px solid var(--border-glass); border-radius: 0.6rem; padding: 0.45rem 0.6rem; height: 100%; } .metric-tile .metric-name { display: block; font-size: 0.62rem; text-transform: uppercase; letter-spacing: 0.04em; color: var(--text-muted); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; } .metric-tile .metric-value { display: block; font-size: 0.8rem; font-weight: 700; margin-top: 2px; } .metric-bad .metric-value { color: var(--sev-critical); } .metric-warn .metric-value { color: #facc15; } .metric-good .metric-value { color: #4ade80; } .chip { display: inline-flex; align-items: center; border-radius: 9999px; padding: 0.18rem 0.6rem; font-size: 0.72rem; font-weight: 600; border: 1px solid; text-decoration: none; line-height: 1.4; } .chip-cwe { background: rgba(34, 211, 238, 0.12); color: #67e8f9; border-color: rgba(34, 211, 238, 0.35); } .chip-alias { background: rgba(0, 240, 255, 0.08); color: #22d3ee; border-color: rgba(0, 240, 255, 0.35); } .chip-alias:hover { background: rgba(0, 240, 255, 0.2); color: #a5f3fc; } .chip-vendor { background: rgba(96, 165, 250, 0.12); color: #93c5fd; border-color: rgba(96, 165, 250, 0.35); } .chip-capec { background: rgba(245, 158, 11, 0.1); color: #fbbf24; border-color: rgba(245, 158, 11, 0.35); } .chip-capec:hover { background: rgba(245, 158, 11, 0.22); color: #fde68a; } .chip-attack { background: rgba(248, 113, 113, 0.1); color: #fca5a5; border-color: rgba(248, 113, 113, 0.35); } .chip-attack:hover { background: rgba(248, 113, 113, 0.22); color: #fecaca; } .chip-product { background: rgba(52, 211, 153, 0.1); color: #6ee7b7; border-color: rgba(52, 211, 153, 0.3); } .dossier-refs li { padding: 0.15rem 0; } .dossier-refs a { color: #7dd3fc; text-decoration: none; font-size: 0.78rem; word-break: break-all; } .dossier-refs a:hover { color: #bae6fd; text-decoration: underline; } .dossier-meta { background: rgba(30, 41, 59, 0.4); border: 1px solid var(--border-glass); } /* --- Welle ML-16 (27.09.): Light-Scopes der themenunabhaengig gepinnten Dark-Paletten (R8-Walk-Funde auf #f8fafc). 600/700er- Pendants, alle >= 4.5:1 auf der Light-Glasflaeche. --- */ html[data-bs-theme="light"] .text-critical-rose { color: #be123c; } /* LH1-W4b: EUVD/CWE/Alias-Badges auf #075985 vertieft (wie badge-low) — #0369a1 lag auf der Panel-Fläche (#ccdfea-Blend) bei 4,3:1. */ html[data-bs-theme="light"] .badge-euvd { background: rgba(8, 145, 178, 0.1); color: #075985; border-color: rgba(8, 145, 178, 0.4); } /* Zeit- & Bedrohungs-Signale (10.10.2026): 600/700er-Pendants auf Light-Glas (gleiche Disziplin wie die Zeile darüber). */ html[data-bs-theme="light"] .badge-new { background: #0e7490; color: #fff; } html[data-bs-theme="light"] .epss-trend.up { color: #b91c1c; } html[data-bs-theme="light"] .epss-trend.down { color: #15803d; } html[data-bs-theme="light"] .chip-cwe { background: rgba(8, 145, 178, 0.08); color: #075985; border-color: rgba(8, 145, 178, 0.35); } html[data-bs-theme="light"] .chip-alias { background: rgba(8, 145, 178, 0.08); color: #075985; border-color: rgba(8, 145, 178, 0.35); } html[data-bs-theme="light"] .chip-alias:hover { background: rgba(8, 145, 178, 0.16); color: #075985; } html[data-bs-theme="light"] .chip-vendor { background: rgba(29, 78, 216, 0.08); color: #1d4ed8; border-color: rgba(29, 78, 216, 0.35); } html[data-bs-theme="light"] .chip-capec { background: rgba(180, 83, 9, 0.08); color: #b45309; border-color: rgba(180, 83, 9, 0.35); } html[data-bs-theme="light"] .chip-capec:hover { background: rgba(180, 83, 9, 0.16); color: #92400e; } html[data-bs-theme="light"] .chip-attack { background: rgba(185, 28, 28, 0.08); color: #b91c1c; border-color: rgba(185, 28, 28, 0.35); } html[data-bs-theme="light"] .chip-attack:hover { background: rgba(185, 28, 28, 0.16); color: #991b1b; } html[data-bs-theme="light"] .chip-product { background: rgba(4, 120, 87, 0.08); color: #047857; border-color: rgba(4, 120, 87, 0.3); } html[data-bs-theme="light"] .dossier-refs a { color: #0369a1; } html[data-bs-theme="light"] .dossier-refs a:hover { color: #075985; } html[data-bs-theme="light"] .dossier-meta { background: rgba(226, 232, 240, 0.5); } html[data-bs-theme="light"] .metric-good .metric-value { color: #047857; } /* MFF-2.5 (28.09.): Gegenheilung der hartcodierten Dunkel-Stats-Boxen — .metric-tile/.vendor-stat-tile blieben im Light dunkel, während die Text-Tokens (--text-muted/--sev-*) auf dunkle 600/700er kippten (dunkel-auf-dunkel). Flächen folgen dem Light-Glas-Vertrag, .metric-warn erhält sein 600er-Pendant (#facc15 → #a16207). */ html[data-bs-theme="light"] .metric-tile { background: rgba(226, 232, 240, 0.55); } html[data-bs-theme="light"] .metric-warn .metric-value { color: #a16207; } html[data-bs-theme="light"] .vendor-stat-tile { background: rgba(226, 232, 240, 0.5); } html[data-bs-theme="light"] .vendor-stat-tile:hover { background: rgba(226, 232, 240, 0.8); border-color: rgba(8, 145, 178, 0.5); } /* text-warning liegt Bootstrap-default (#ffc107) auf Light bei 1.6:1 — Projekt-Heiler aus RCI (#b45309) nachziehen, da /cve die globalen CSS-Ketten nicht laedt. */ /* LH1-W4b: Light-Töne auf die 800er-Stufe vertieft — #b45309/#0e7490 lagen auf der soliden Panel-Fläche #e2e8f0 bei 4,1–4,3:1 (grenzwertig gefailt); #92400e/#155e75 halten 6+:1 auf Glas UND Panel. */ html[data-bs-theme="light"] .cve-page .text-warning { color: #92400e !important; } /* Vendor-Dots/-Linien (Chart-Legende) erhalten ihre Light-Farbe als --vc-light inline aus dem PHP-Map (dunkler Wert bleibt Inline-Style). */ html[data-bs-theme="light"] .vendor-dot { color: var(--vc-light, #475569) !important; } html[data-bs-theme="light"] .vendor-line { stroke: var(--vc-light, #64748b); } /* ML-3b (27.09., ergänzend zu ML-16): Stats-Inseln — Bootstrap-.text-info (#0dcaf0) auf der hellen Glasfläche ≈1.7:1 (R8-Walk; intel-value, EUVD-ID, CW-/EPSS-Tabellen). #0e7490 = 5.1:1. */ html[data-bs-theme="light"] .cve-page .text-info { color: #155e75 !important; } /* .badge-low war der einzige ungescoopete Severity-Badge (#7dd3fc auf Light-Glas ~2:1) — gleicher Aufbau wie badge-euvd oben. */ html[data-bs-theme="light"] .badge-low { background: rgba(8, 145, 178, 0.1); color: #075985; border-color: rgba(8, 145, 178, 0.4); } /* LH1-W4b (01.10., Kontrast-Langtail 13/54 → 0): Die rgba(30,41,59,α)- Panels blendeten über dem hellen Grund auf #525b69/#a1a6af/#b7bbc2 — Token-Texte (#475569/#334155/#b45309/#0e7490) darauf = 1,2–4,4:1. Solide Light-Fläche via Theme-Var (Inline-Styles konsumieren sie). */ html[data-bs-theme="light"] .cve-page { --cve-panel-bg: #e2e8f0; } /* Filter-Pills: rgba-Glas + text-muted kippte auf 1,2:1 — solides Light- Paar; Aktiv-/Hover-Zustand Weiß-auf-Cyan (3,0) → Weiß auf sky-800. */ html[data-bs-theme="light"] .cve-page .filter-btn { background: #e2e8f0; color: #334155; border-color: #cbd5e1; } html[data-bs-theme="light"] .cve-page .filter-btn:hover, html[data-bs-theme="light"] .cve-page .filter-btn.active { background: #0369a1; color: #ffffff; border-color: #0369a1; } /* Aktiv-Filter-Chip: --cyan-soft (#0891b2) auf --cyan-bg ≈ 3,5:1. */ html[data-bs-theme="light"] .cve-page .filters-active-chip { color: #0c4a6e; } /* Card-/Matrix-Outline-Buttons: Bootstrap btn-outline-info-Text #0dcaf0 auf heller Karte (21× gemessen) → cyan-800. */ html[data-bs-theme="light"] .cve-page .btn-outline-info { color: #155e75 !important; border-color: rgba(21, 94, 117, 0.6); } /* Navbar-CVE bleibt dunkel — die Light-Heiler (#92400e/#155e75) dürfen die dunklen Navbar-Pills nicht treffen (dort 2,6–3,0:1); helle 300er-Töne bestehen auf #232630 mit 7–8:1. Deckt cmdkTrigger mit. */ html[data-bs-theme="light"] .navbar-cve .text-warning, html[data-bs-theme="light"] .navbar-cve .btn-warning, html[data-bs-theme="light"] .navbar-cve .btn-outline-warning { color: #f59e0b !important; } html[data-bs-theme="light"] .navbar-cve .text-info, html[data-bs-theme="light"] .navbar-cve .btn-outline-info { color: #22d3ee !important; } /* LH1-W4b: Lesezeichen-Pill (btn-outline-warning) — spezifischere (0,3,1)-Regel, damit kein anderes Light-Heilen durchgreifen kann. */ html[data-bs-theme="light"] .navbar-cve a.btn-outline-warning { color: #f59e0b !important; border-color: rgba(245, 158, 11, 0.6) !important; } /* --- Multiselect (Hersteller-Filter aus der EUVD-Datenquelle) --- */ .multiselect { position: relative; } .ms-panel { background: var(--surface-glass); backdrop-filter: blur(16px); border: 1px solid var(--border-glass); border-radius: 0.9rem; padding: 0.75rem; margin-top: 0.5rem; width: min(100%, 26rem); } .ms-options { max-height: 16rem; overflow-y: auto; display: flex; flex-direction: column; gap: 0.15rem; } .ms-option { display: flex; align-items: center; gap: 0.5rem; padding: 0.3rem 0.5rem; border-radius: 0.5rem; cursor: pointer; font-size: 0.8rem; color: var(--color-text-heading, #e2e8f0); } .ms-option:hover { background: rgba(0, 240, 255, 0.07); } .ms-option input { accent-color: var(--cyan); } .ms-option .ms-name { flex: 1 1 auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; } .ms-count { flex: 0 0 auto; font-size: 0.66rem; font-weight: 700; color: #67e8f9; background: rgba(0, 240, 255, 0.1); border: 1px solid rgba(0, 240, 255, 0.25); border-radius: 9999px; padding: 0.05rem 0.45rem; font-variant-numeric: tabular-nums; } /* --- Intelligence-Stats-Kacheln (Landing) --- */ .intel-tile { background: var(--surface-glass); backdrop-filter: blur(12px); border: 1px solid var(--border-glass); border-radius: var(--radius-tile); padding: 0.85rem 0.95rem; height: 100%; transition: transform 0.2s ease, border-color 0.2s ease; } .intel-tile:hover { border-color: var(--cyan-border-strong); transform: translateY(-2px); } .intel-tile .intel-value { display: block; font-size: 1.3rem; font-weight: 800; line-height: 1.15; } .intel-tile .intel-label { display: block; font-size: 0.66rem; text-transform: uppercase; letter-spacing: 0.05em; color: var(--text-muted); margin-top: 0.2rem; } /* --- Render-Performance: 60 Karten ohne Offscreen-Paint-Kosten --- */ .cve-item { content-visibility: auto; contain-intrinsic-size: auto 320px; } /* --- Karten-Stagger: sanftes Einlaufen, gedeckelt auf 12 --- */ #cveGrid .cve-item { animation: fade-in-up 0.4s ease-out both; } #cveGrid .cve-item:nth-child(1) { animation-delay: 0.02s; } #cveGrid .cve-item:nth-child(n+2):nth-child(-n+12) { animation-delay: calc((var(--stagger, 0) + 0.02s) + 0.018s * (n - 1)); } #cveGrid .cve-item:nth-child(n+13) { animation-delay: 0.24s; } /* --- Sticky-Layout --- */ .navbar-cve { position: sticky; top: 0; z-index: 1030; } @media (max-width: 767.98px) { .navbar-cve .container { flex-wrap: wrap; gap: 0.75rem; } .navbar-cve .container > div:last-child { flex-wrap: wrap; width: 100%; justify-content: flex-start; gap: 0.5rem; } .navbar-cve .btn-sm { padding: 0.35rem 0.65rem; font-size: 0.78rem; } } @media (min-width: 992px) { .dossier-aside { position: sticky; top: 5rem; } } /* --- Filter-Aktiv-Anzeige + Empty-State --- */ .filters-active-chip { display: inline-flex; align-items: center; gap: 0.4rem; background: var(--cyan-bg); border: 1px solid var(--cyan-border); color: var(--cyan-soft); border-radius: var(--radius-pill); padding: 0.25rem 0.8rem; font-size: 0.78rem; font-weight: 700; } .empty-state { border: 1px dashed var(--border-glass); border-radius: var(--radius-card); } /* --- Command-Palette (⌘K) --- */ .cmdk-backdrop { position: fixed; inset: 0; z-index: 2000; background: rgba(7, 12, 24, 0.7); backdrop-filter: blur(4px); display: flex; align-items: flex-start; justify-content: center; padding: 8vh 1rem 1rem; } .cmdk-panel { width: min(100%, 40rem); background: var(--surface-glass); backdrop-filter: blur(24px); border: 1px solid var(--cyan-border); border-radius: 0.9rem; box-shadow: 0 24px 60px rgba(0, 0, 0, 0.5), 0 0 40px rgba(0, 240, 255, 0.06); overflow: hidden; } .cmdk-input { width: 100%; background: transparent; border: 0; outline: none; color: #f8fafc; font-size: 1rem; padding: 0.9rem 1.1rem; border-bottom: 1px solid var(--border-glass); } .cmdk-input::placeholder { color: var(--text-muted); } .cmdk-list { max-height: 18rem; overflow-y: auto; padding: 0.4rem; } .cmdk-item { display: flex; align-items: center; gap: 0.6rem; padding: 0.5rem 0.7rem; border-radius: 0.5rem; color: #e2e8f0; text-decoration: none; font-size: 0.88rem; cursor: pointer; } .cmdk-item:hover, .cmdk-item[aria-selected="true"] { background: var(--cyan-bg); color: #fff; } .cmdk-item .cmdk-hint { margin-left: auto; font-size: 0.68rem; color: var(--text-muted); } .cmdk-section { font-size: 0.64rem; text-transform: uppercase; letter-spacing: 0.08em; color: var(--text-muted); padding: 0.5rem 0.7rem 0.2rem; font-weight: 700; } .cmdk-foot { display: flex; gap: 1rem; padding: 0.5rem 0.9rem; font-size: 0.66rem; color: var(--text-muted); border-top: 1px solid var(--border-glass); background: rgba(7, 12, 24, 0.3); } .cmdk-foot kbd { background: var(--surface-2); border: 1px solid var(--border-glass); border-radius: 0.3rem; padding: 0 0.3rem; font-family: var(--font-mono); } /* --- Mobile-Filter ( .row { display: none; } #filterMatrix.expanded > .row { display: flex; } } /* --- Respekt vor reduced-motion: alles Bewegliche aus --- */ @media (prefers-reduced-motion: reduce) { *, *::before, *::after { animation-duration: 0.01ms !important; animation-iteration-count: 1 !important; transition-duration: 0.01ms !important; } .cve-card:hover, .intel-tile:hover, .vendor-stat-tile:hover { transform: none; } } /* --- Ausnutzungs-Timeline (Dossier, CSS-only) --- */ .ex-timeline { position: relative; padding: 0.2rem 0 0.1rem; } .ex-timeline-line { position: absolute; left: 0.55rem; right: 0.55rem; top: 0.62rem; height: 2px; background: linear-gradient(90deg, var(--cyan-border) 0%, rgba(248, 113, 113, 0.5) 100%); } .ex-timeline-points { display: flex; justify-content: space-between; position: relative; } .ex-tl-point { display: flex; flex-direction: column; align-items: center; gap: 0.3rem; flex: 1; min-width: 0; } .ex-tl-dot { width: 0.72rem; height: 0.72rem; border-radius: 50%; background: var(--surface-3); border: 2px solid var(--text-muted); flex-shrink: 0; } .ex-tl-point.is-milestone .ex-tl-dot { background: var(--cyan); border-color: var(--cyan); box-shadow: 0 0 8px rgba(0, 240, 255, 0.5); } .ex-tl-point.is-kev .ex-tl-dot { background: var(--sev-critical); border-color: var(--sev-critical); box-shadow: 0 0 8px rgba(239, 68, 68, 0.55); } .ex-tl-label { font-size: 0.6rem; text-transform: uppercase; letter-spacing: 0.06em; color: var(--text-muted); text-align: center; line-height: 1.25; } .ex-tl-value { font-size: 0.68rem; font-weight: 700; color: #e2e8f0; font-family: var(--font-mono); text-align: center; } .ex-tl-point.is-kev .ex-tl-value { color: var(--sev-critical); } /* --- Toast (Share-Feedback) --- */ .tsec-toast { position: fixed; right: 1.2rem; bottom: 1.2rem; z-index: 2100; background: var(--surface-glass); backdrop-filter: blur(16px); border: 1px solid var(--cyan-border); color: #e2e8f0; border-radius: 0.7rem; padding: 0.6rem 1rem; font-size: 0.85rem; font-weight: 600; box-shadow: 0 12px 30px rgba(0, 0, 0, 0.45); } /* --- Karten-Titel: Text-Link-Affordanz --- */ .cve-card h3 a { text-decoration: none; } .cve-card h3 a:hover, .cve-card h3 a:focus-visible { text-decoration: underline; text-decoration-color: var(--cyan-border-strong); text-underline-offset: 3px; } /* --- Druck-Ansicht: Dossier als heller Report-Anhang --- */ @media print { @page { margin: 14mm 12mm; } body { background: #fff !important; color: #111 !important; } body .text-muted { color: #555 !important; } .navbar-cve, .filters-toggle, #filterMatrix, #cveSearchInput, .input-group, #cmdkBackdrop, #cmdkTrigger, .watchlist-modal, .modal, .modal-backdrop, .filters-active-chip, .empty-state, .tsec-toast, #cveEmptyState, .vendor-stat-tile, .intel-tile, .dossier-refs a::before { display: none !important; } main.container { max-width: 100%; padding: 0; } /* Dossier: Collapse-Inhalte immer drucken */ .collapse { display: block !important; } .cve-card, .dossier-meta, .cmdk-panel, .metric-tile, .ms-panel { background: #fff !important; backdrop-filter: none !important; border-color: #bbb !important; box-shadow: none !important; color: #111 !important; } .cve-card.critical { border-left-color: #b91c1c !important; } .cve-card.high { border-left-color: #c2410c !important; } .cve-card.medium { border-left-color: #a16207 !important; } .text-white, .fw-bold.text-white { color: #111 !important; } .text-info { color: #0e7490 !important; } /* Referenz-URLs sichtbar machen */ .dossier-refs a::after { content: " (" attr(href) ")"; font-size: 0.66rem; color: #555; word-break: break-all; } /* Grid 2-spaltig, Karte kompakt */ #cveGrid { display: grid !important; grid-template-columns: 1fr 1fr; gap: 6mm; } #cveGrid .cve-item { content-visibility: visible; contain-intrinsic-size: none; break-inside: avoid; } .ex-timeline-line { background: #999 !important; } a { color: #0e7490 !important; text-decoration: none; } } /* W14 (07.09., Auto-Audit): Dark-Lock-Kontraste — Bootstrap-Konstanten (text-danger #dc3545, text-success #198754, outline-secondary) liegen auf den fixen Dunkel-Islands der Seite bei 3.4–4.2:1. Heiler im Layer `bootstrap` (text-*-Utilities tragen !important — ungeschichtete normale Regeln verlieren gegen geschichtete Importants, css-cascade-5; dieses
🛡️ tsecurity.de
Zur Startseite 🏭 Hersteller 🧭 ATT&CK 🎯 Ausgenutzt 🔖 Lesezeichen
🎯 CVE-2025-4524 🇪🇺 EUVD
💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!

CVE-2025-4524 | The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases w

The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Klassifikation & Betroffenheit:
WPStylish Madara – Responsive and modern WordPress theme for manga sites 0 ≤2.2.2
Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.
Vollständige Definition bei MITRE ➔
⚔️ Typische Angriffsmuster (CAPEC):
CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)
🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):
T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking
Ausnutzungs-Zeitleiste:
CVSS-Vektor-Analyse: 9.8
AV · Angriffsvektor Netzwerk
AC · Komplexität Gering
PR · Privilegien Keine
UI · Interaktion Keine
S · Scope Unverändert
C · Vertraulichkeit Hoch
I · Integrität Hoch
A · Verfügbarkeit Hoch
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Veröffentlicht:21.05.2025
Aktualisiert:17.06.2026 09:33
Assigner (CNA):Wordfence
EUVD-ID:EUVD-2025-15990
Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache
CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar
💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.
🗨 Diskussion zu CVE-2025-4524 0 Beiträge
Antworten, Upvotes & Reaktionen — wie im Community-Feed. Markdown und ```Code``` unterstützt.

Noch keine Analyse zu CVE-2025-4524

Sei der Erste: Einschätzung, Betroffenheit, Workaround oder PoC — mit Antworten im Thread.

↩️ Antworten auf:

Beitrag zu CVE-2025-4524 verfassen

Neu hier? Als Mitglied sammelst du Karma für Beiträge und Answers.
📧
Code-Formatierung: ```bash ... ``` oder `inline code` 0 / 2000
🔴 Live Security Advisory & EPSS Exploit Radar

Zero-Day & Vulnerability Intelligence Hub

Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.

🟢 SSE Realtime Synchronisiert ⚡ REST API (JSON) 📡 Digest (RSS) 📡 RSS Feed
375k+ 🇪🇺 EUVD-Datenbank
1 🔴 Critical im Radar
0 ⚠️ CISA KEV
0 🔓 Aktiv ausgenutzt
0 🧪 PoC verfügbar
6 🆕 Neu im KEV (7 T)
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
🔴 Criticals pro Monat (12 M) 2025-11: 257 Nov 25 2025-12: 426 2026-01: 431 Jan 26 2026-02: 417 2026-03: 649 Mär 26 2026-04: 574 2026-05: 682 Mai 26 2026-06: 941 2026-07: 1327 Jul 26 2026-08: 1827 2026-09: 1513 Sep 26 2026-10: 397 9.441 Criticals gesamt
🏢 Top-Vendor-Veröffentlichungen (6 M) Apache Software Foundation Google IBM Linux Microsoft Oracle Corporation
● Apache ● Google ● IBM ● Linux ● Microsoft ● Oracle
📈 EPSS-Verteilung (Messungen)
TierCVEsAnteil
≥90 %7200,2 %
≥50 %3.2230,9 %
≥10 %22.1156,0 %
<10 %342.37392,9 %
368.431 CVEs mit EPSS-Score (FIRST.org) · Stand 10.10.2026
📈 EPSS-Riser (7 Tage) CVE-2025-8943 ↑ 9.02 % CVE-2024-11972 ↑ 4.58 % CVE-2023-42442 ↑ 4.49 %
Frühindikator · FIRST.org
Datenquellen & Methodik: Primärquelle ist die EUVD der ENISA (laufender Datenbank-Sync, alle 15 Minuten), abgeglichen mit dem CISA-KEV-Katalog und der NVD — Detail-Dossiers reichern fehlende Felder live per NVD an — mit Fallback auf CIRCL vulnerability-lookup (EU/Non-Profit, aggregiert CVE-, GitHub- und OSV-Advisories). Der CISA-KEV-Katalog (Known Exploited Vulnerabilities, ~1.700 aktiv ausgenutzte Schwachstellen) wird bei jedem Sync vollständig neu geladen und kreuzreferenziert — filterbar über die KEV-Pille. CVSS 3.1 wird nach Ampel-Logik aus Verteidigersicht dekodiert; EPSS bezeichnet die 30-Tage-Exploit-Wahrscheinlichkeit (FIRST.org).
🇪🇺 ENISA EUVD 🇺🇸 NVD ⚠️ CISA KEV ⚡ EPSS
Ökosystem & Hersteller Bedrohungs-Matrix:
Schweregrad & Status:
Hersteller (Datenbank-weit, 99.196 Einträge):
EPSS-Schwelle:
Exploit-Status:
Zeitfenster:
Sortierung:
Quelle:
Schwachstellen-Kategorie (CWE):
🔍
9.8 CRITICAL
EPSS 10.4%
CVE-2025-4524 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig
WPStylish

CVE-2025-4524 | The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases w

The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticate

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar
💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.
🛡️ Details ➔
1 von ~1 Einträgen geladen Ende der Trefferliste — 1 Einträge geladen. Tipp: Filter leichtern für tieferes Blättern.