CVE-2025-4884

creationtimestamp| type| source ---|---|--- 2025-05-18 15:55:07+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lphg6rv7yz72 2025-05-18 17:12:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lphkjypayx2p...

MAL-2025-3939 Malicious code in spingroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c39f718dbb6417a92610be6705edea190e4adbccbe0a2e80ede465e0a307c917 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-4867

creationtimestamp| type| source ---|---|--- 2025-05-18 09:41:07+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpgrbxq7ayb2 2025-05-18 13:08:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lph4vdluzh2v...

MAL-2025-3935 Malicious code in eslint-plugin-i18n-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52f5d25719716952625ab6fabacd4ccb2743e7066584b9b76cf5c198a0ebfc66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-4852

creationtimestamp| type| source ---|---|--- 2025-05-18 04:32:51+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpg7xzunvkn2 2025-05-18 05:08:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpgc2cr7c42t 2025-05-19...

CVE-2025-4858

creationtimestamp| type| source ---|---|--- 2025-05-18 04:32:07+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpg7xhjrfqg2 2025-05-18 05:08:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpgc2ckot52o 2025-05-19...

CVE-2025-4841

creationtimestamp| type| source ---|---|--- 2025-05-18 00:39:58+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpfsznapxpb2 2025-05-18 01:13:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpfuvqzygv2s...

Malicious code in novacredit-global2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e08d91b667c736598ff5998d53a62bc833b8a740b0cd678a4ff9b2a33c99866a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-47948

creationtimestamp| type| source ---|---|--- 2025-05-17 12:33:11+00:00| published-proof-of-concept| https://github.com/cocotais/cocotais-bot/security/advisories/GHSA-mj2c-8hxf-ffvq 2025-05-17 20:31:28+00:00| seen|...

MAL-2025-3930 Malicious code in blahblahblah-definitely-not-a-real-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2200fcdc37007fa010dea283e42096c6211571af64a48492a2fe0b550a39ac62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apilogicserver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8beaeb43103672154062bf9b44734e305dad9ba1e9bbc6453d539cefa3e29f62 The OpenSSF Package Analysis project identified 'apilogicserver' @ 14.5.0 pypi as malicious. It is considered malicious because: - The package...

WordPress User Activity Tracking and Log plugin < 4.1.4 - IP Spoofing vulnerability

IP Spoofing vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin User Activity Tracking and Log versions 4.1.4...

GHSA-C7VQ-M7F8-RX37

creationtimestamp| type| source ---|---|--- 2025-05-16 14:39:43+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16691 2025-05-16 15:17:25+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114518172966589726...

MAL-2025-3967 Malicious code in maddddddterialxtest (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fba69f39bbe6232d97fbed1db9a38bd6a0de496acb93a26672b5bee18a28a307 Any computer that has this package installed or running should be considered...

CVE-2024-0970

This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value...

CVE-2024-0970

This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value...

CVE-2024-0970 User Activity Tracking and Log < 4.1.4 - IP Spoofing

This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value...

CVE-2024-0970 User Activity Tracking and Log < 4.1.4 - IP Spoofing

This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value...

CVE-2023-6030 LogDash Activity Log < 1.1.4 - Unauthenticated SQLi

The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wploginfailed function from src/Hooks/Users.php in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploite...

CVE-2023-6030

The CVE-2023-6030 entry relates to the WordPress plugin LogDash Activity Log (versions before 1.1.4). The vulnerability arises when the plugin logs failed logins in src/Hooks/Users.php via wp_login_failed without escaping the username in a SQL query, causing a SQL injection. The risk is described...