CVE-2018-25392 MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the logactivity function. Attackers can send POST requests to /index.php/user/logactivity with malicious SQL code in...

CVE-2018-25392

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability exploitable by authenticated users through the log_activity function. The flaw occurs in /index.php/user/log_activity where parameters nomor, user, and jenis can be tainted with arbitrary SQL. Successful exploitation can enumerate...

EUVD-2018-21914

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the logactivity function. Attackers can send POST requests to /index.php/user/logactivity with malicious SQL code in...

CVE-2018-25392 MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the logactivity function. Attackers can send POST requests to /index.php/user/logactivity with malicious SQL code in...

Malicious code in sorenson-webfonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d45b3e803fc04f697e067f5dfbc9a9c37878d1b7faed2ad4aea69dd9bed25c32 [email protected] is a hollow package: index.js is a 2-line stub 'use strict'; module.exports = ;, author/description fields are empty, and th...

Mautic 安全漏洞

Mautic is an open-source marketing automation software developed by Mautic. This software can monitor and manage websites, send emails, and manage customer resources. Version 7 of Mautic has a security vulnerability, which stems from path traversal in the activity import function. This...

PT-2026-44870

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the log activity function. Attackers can send POST requests to /index.php/user/log activity with malicious SQL code ...

Maxon ERP SQL注入漏洞

Maxon ERP is an ERP software developed by Maxon ERP Corporation. The SQL injection vulnerability exists in versions 8.x to 9.x of Maxon ERP Software. This vulnerability stems from the nomor, user, and jenis parameters in the logactivity function, which may allow authenticated users to execute...

PT-2026-45062

Name of the Vulnerable Software and Affected Versions praisonai-platform affected versions not specified Description An Insecure Direct Object Reference exists in the multi-tenant deployment. The endpoint '/workspaces/workspace id/issues/issue id/activity' uses the workspace id only to verify...

GHSA-339W-3HQM-9PJC Casdoor doesn't verify that a JWT used for token exchange is still active

Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken function in object/tokenoauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revok...

Malicious code in nemo-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42a43ec0a345170ad191fa1c25bdd4000595aa8ce733c6b9c69de6b65a1defb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4836 Malicious code in nemo-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42a43ec0a345170ad191fa1c25bdd4000595aa8ce733c6b9c69de6b65a1defb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-44426

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.362.1 Description Casdoor fails to verify if a JSON Web Token JWT used for token exchange remains active. The GetTokenExchangeToken function in object/token oauth.go validates the JWT signature and parses its claims...

MAL-2026-4908 Malicious code in @cloudplatform-single-spa/dataplatform-flink (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

MAL-2026-4901 Malicious code in @cloudplatform-single-spa/cp-api-gw (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

CVE-2026-46028

A flaw was found in the Linux kernel's algifaead Authenticated Encryption with Associated Data subsystem. Asynchronous async requests for AEAD operations use a shared initialization vector IV buffer. This shared state can be modified by subsequent socket activity before an async request fully...

Basecamp: Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity

A vulnerability was discovered in the Basecamp Android app that allowed any installed app to force immediate logout and persistent denial-of-service of authenticated Basecamp sessions. The vulnerability was due to the com.basecamp.bc4.app.main.start.StartActivity being declared as exported withou...

GHSA-9RFG-V8G9-9367 Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

As told on Discord earlier, multiple projects are affected, and we would like to coordinate. For now, we are aiming at a May 6th release date, but this is not set in stone yet. Summary An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify...

Malicious code in unleash-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3315b3ff9fe481a7a008cff1227c2449dd8762bdf0abbe1a6194954306c745d [email protected] is an empty stub package index.js exports , 35 bytes; no author, no description whose sole effect is to pull a chained dependency...

MAL-2026-4826 Malicious code in wm-mapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 380f281f71ec04bc9867a9b12d46852936494de6d2be3df55b1422bde2f5f01d [email protected] is an empty stub index.js is 35 bytes exporting , no description, no author published at an artificially high version 99.9.1...