EUVD-2025-147426

Malicious code in tusaaya-s-wfesaq npm...

EUVD-2025-147414

Malicious code in tusaaya-sdss-s npm...

EUVD-2025-147434

Malicious code in tusaaya-ddv-s npm...

EUVD-2025-147418

Malicious code in tusaaya-sad-s npm...

EUVD-2025-147430

Malicious code in tusaaya-s-rfe npm...

MAL-2025-159859 Malicious code in mansila-tla-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68d473934d3bd406031e812bb37aa93827c6e490db64f278010bf406ee8d160e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vida-bakwan71-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8996b73edb18c7395dafb25c463fa3267749cdb4d3b43c998c4738a1b3f288e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including SAP NetWeaver, SAP Business Connector, SAP HANA, and SAP S/4HANA. The vulnerabilities include deserialization, code injection, insufficient validation, and information disclosure. These vulnerabilities can be exploited by attackers to...

CVE-2025-42924: URL Redirection to Untrusted Site

SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page controlled by the attacker. This has low impact on confidentiality and integrity of the application with no impact on availability...

CVE-2025-63154

TOTOLink A7000R V9.1.0u.6115B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-63384: Incorrect Privilege Assignment

A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET Supervisor-mode Exception Return instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode M-mode to Supervisor-mode S-mode as specified by...

CVE-2025-34299: Unrestricted Upload of File with Dangerous Type

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious SFTP server...

CVE-2025-12197

The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticat...

CVE-2025-12197

The CVE-2025-12197 affects The Events Calendar WordPress plugin (versions 6.15.1.1–6.15.9). The issue is a blind SQL Injection in the s parameter caused by insufficient escaping and lack of proper query preparation, allowing unauthenticated attackers to append additional SQL and potentially exfil...

CVE-2025-12197 The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s

The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticat...

PT-2025-45070

Name of the Vulnerable Software and Affected Versions The Events Calendar plugin for WordPress versions 6.15.1.1 through 6.15.9 Description The Events Calendar plugin for WordPress is susceptible to a blind SQL injection issue. This is due to inadequate escaping of user-provided input and...

CVE-2025-12197: Improper Neutralization of Special Elements used in an SQL Command

The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticat...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989724)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989724 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: filter out EXT4FCREPLAY from on-disk superblock field sstate The EXT4FCREPLAY bit in...

CVE-2025-10748

The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-10748

The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...