EulerOS Virtualization 2.13.1 : samba (EulerOS-SA-2026-3197)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...

Linux Distros Unpatched Vulnerability : CVE-2026-65053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In...

CVE-2022-30983

A cross-site scripting XSS vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parameter...

react2shellNSE

React2Shell PRO v2 – NSE Script Autor: Saad Ayady Licencia: Igual que Nmap código abierto Categoría: Seguro, Descubrimiento, Detección de Vulnerabilidades Estado: Solo detección, no explotación Resumen React2Shell PRO v2 es un script NSE avanzado de Nmap para detectar componentes de servidor Reac...

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

EUVD-2026-65075

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503

Dolibarr before 24.0.0 is affected by a reflected cross-site scripting (XSS) vulnerability in the extra fields administration template . The type request parameter is reflected without JavaScript-context encoding into an inline [removed] block, and no Content-Security-Policy header is emitted. An...

CVE-2026-30864 Combodo iTop: Reflected XSS in dashboard revert

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting XSS in the dashboard revert functionality. This issue has been fixed in version 3.2.3...

Malicious code in paypal-business-sdk (npm)

Source: amazon-inspector 556bfd93652f806523495944dc8a441624c9a2dae4f76eadeefa9650f57091a1 The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, and walks up to 15 parent directories to read enclosing package.json files capturing t...

Malicious code in poly-price-node (npm)

Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which reads the installer's.env file from INITCWD/cwd, parses it...

Malicious code in ppb-manticore (npm)

Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward through parent directories to read the enclosing project'...

Malicious code in manticore-log (npm)

Source: amazon-inspector 184c02a26613b94b15f0abe1ed108c7a2a7a061f795213dba4772876e6e0a015 The package's preinstall lifecycle script fires automatically on npm install and collects the installer's OS username, hostname, current working directory, and the enclosing project's package.json...

Malicious code in consumerweb-serverutils (npm)

Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working directory, walks up the directory tree to read the...

Malicious code in auth-otp (npm)

Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script. lib/core.js first checks for CI/audit/pack indicators CI,...

Malicious code in @medisend/webview-bridge (npm)

Source: amazon-inspector ddf4b396c306b8f8d090b929c265b8ae848c75e53b9750d6f68800a4deefe9a2 package.json declares a postinstall lifecycle script that runs curl to https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with query parameters populated from $whoami, $hostname, $pwd, $ls -la, and...

Malicious code in @medisend/auth (npm)

Source: amazon-inspector 8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003 package.json declares a postinstall lifecycle script that runs curl against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the installer's hostname appended as a query parameter...

Malicious code in @medisend/shared (npm)

Source: amazon-inspector cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28 package.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname via $hostname as a query parameter to a webhook.site collector. The receiver ID in t...