MAL-2025-417 Malicious code in coinbase-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bfca6e22bde9e7158f92c9dac3a4b739e2c3b38cb8e2a96cdd1ad74e5e48e0ac The OpenSSF Package Analysis project identified 'coinbase-checkout' @ 999.9.9 npm as malicious. It is considered malicious because: - The packag...

Malicious code in bookingcom-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68d25686015085f4d524b134542a14b1748266da0711ecc36ae2a59afe2abebf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-399 Malicious code in bookingcom-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68d25686015085f4d524b134542a14b1748266da0711ecc36ae2a59afe2abebf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-373 Malicious code in amazon-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4728fc0ef630dde9616340e6f9a3571e2bb5e75e034fac804e6ca9b0030a7846 The OpenSSF Package Analysis project identified 'amazon-checkout' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in amazon-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4728fc0ef630dde9616340e6f9a3571e2bb5e75e034fac804e6ca9b0030a7846 The OpenSSF Package Analysis project identified 'amazon-checkout' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in apple-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7472f2e3c4be462937b9b2f925090cd83a2ba82bfa3e410284bc71df5a51c4a The OpenSSF Package Analysis project identified 'apple-checkout' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-389 Malicious code in apple-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7472f2e3c4be462937b9b2f925090cd83a2ba82bfa3e410284bc71df5a51c4a The OpenSSF Package Analysis project identified 'apple-checkout' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

CVE-2025-23997

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows Stored XSS.This issue affects Tamara Checkout: from n/a through 1.9.9.1...

CVE-2025-23997 WordPress Tamara Checkout plugin < 1.9.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows Stored XSS.This issue affects Tamara Checkout: from n/a through 1.9.9.1...

CVE-2025-23997

CVE-2025-23997 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Tamara Checkout. Connected sources specify that the issue arises from improper neutralization of input during web page generation, affecting Tamara Checkout versions up to 1.9.8 (WordPress plugin context)....

CVE-2025-23997 WordPress Tamara Checkout plugin < 1.9.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows Stored XSS.This issue affects Tamara Checkout: from n/a through 1.9.9.1...

Malicious code in composite-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb0895cfef58bc04374e30ca74fe5937d86332f548841883b7903c9cd2053af0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-287 Malicious code in composite-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb0895cfef58bc04374e30ca74fe5937d86332f548841883b7903c9cd2053af0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-5254 · Unknown · Tamara Checkout

Name of the Vulnerable Software and Affected Versions: Tamara Checkout versions prior to 1.9.9 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicious scrip...

WordPress plugin Tamara Checkout 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Tamara Checkout plugin < 1.9.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis Patchstack Alliance in WordPress Plugin Tamara Checkout versions 1.9.9.1...

gix-worktree-state nonexclusive checkout sets executable files world-writable

Summary gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some...

CVE-2024-13398

CVE-2024-13398 describes a Stored Cross-Site Scripting vulnerability in the Checkout for PayPal WordPress plugin (all versions up to 1.0.32) caused by insufficient input sanitization and output escaping on the plugin’s checkout_for_paypal shortcode attributes. The impact is that authenticated att...

WordPress plugin Checkout for PayPal 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-2154 · WordPress · Checkout For Paypal

Name of the Vulnerable Software and Affected Versions: Checkout for PayPal plugin for WordPress versions up to, and including, 1.0.32 Description: The issue is related to Stored Cross-Site Scripting via the plugin's checkout for paypal shortcode due to insufficient input sanitization and output...