294253 matches found
EUVD-2026-75421
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...
CVE-2026-88870 WWBN AVideo LoginControl PGP Key CSRF via GET Request
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a...
CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...
CVE-2026-88867
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters "name" and "iconClass" to Category::setName and Category::setIconClass, which store the...
EUVD-2026-75416
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...
WordPress Sidebar Manager Light plugin <= 1.18 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Sidebar Manager Light versions = 1.18...
WordPress Redux Framework plugin <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Redux Framework versions = 4.5.13.1...
WordPress Contact Form 7 Captcha plugin 0.1.7-0.1.8 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Contact Form 7 Captcha versions 0.1.7-0.1.8...
Malicious code in extremophile-ophiuchus-rollup-plugin-subscription (npm)
Source: amazon-inspector 0d5814aeadd2075aafefcfdf7e08fa80138940a6d61e92b031d99103d60885e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in express-mini-css-extract-plugin-procyon-acamar (npm)
Source: amazon-inspector e2f68f50a3b19559dfa4d0186fa26e9a37752bdf68b487dd661e43193c194e1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in express-electron-builder-eslint-plugin-firebase (npm)
Source: amazon-inspector b7456305cc58ebdceba37e7f3ac074cb977be82975180ce9e478f8c7d20a17f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in exoplanetology-extremophile-html-webpack-plugin-webdriver-mocha (npm)
The package exoplanetology-extremophile-html-webpack-plugin-webdriver-mocha was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in exoplanetology-eslint-config-eslint-plugin-elara (npm)
Source: amazon-inspector 92dd8ba2ece7a374b69507ba324e1274e708be47b29907e414058f5f3625588c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in event-prettier-plugin-markdown-halley-jsonp (npm)
Source: amazon-inspector 0fd30929afe52bc277b4d8b06cd079e5fbc315319642889508b0c4575f162821 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in event-deimos-mini-css-extract-plugin-mira (npm)
Source: amazon-inspector 10ae3339de31987245b0464e66994d4f5c09550d0710bd98c8ce08bb3c24c76d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in event-html-webpack-plugin-json-sqlite (npm)
Source: amazon-inspector 875e00bfa3e1b4edd4e8060b916a67fb8cd83337e82e497bc92c17e79e411199 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in europa-query-tailwindcss-rollup-plugin (npm)
Source: amazon-inspector 8cf8315d71d14633947bda1a4296c713fe4b4f134f7524fed9bc803b047eb4c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eslint-plugin-weywot-bootes-cypress (npm)
Source: amazon-inspector 8cd1c916db1f971a732417678b685bfbb98d4333956f25b6febdee70d72eb371 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eslint-supervisor-rollup-plugin-hapi (npm)
Source: amazon-inspector f35eaf1dd0ae02b839f771c4647f77510a80e88ff4c7236de32a826f8b817cef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...