Malicious code in jsondatatoruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89f78392e9a3a510c3e509f058c49aff59b8b98fff6beca0f5f30bbb8e85a9bd The package jsondatatoruby was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192584 Malicious code in jsondatatoruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89f78392e9a3a510c3e509f058c49aff59b8b98fff6beca0f5f30bbb8e85a9bd The package jsondatatoruby was found to contain malicious code. Source: ossf-package-analysis...

PT-2025-51436

Name of the Vulnerable Software and Affected Versions AIOSEO Plugin Team Broken Link Checker versions through 1.2.6 Description The Broken Link Checker component contains a flaw due to improper neutralization of special elements within SQL commands, leading to a potential SQL Injection issue. Thi...

PT-2025-51558

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version...

CVE-2025-67744: Improper Control of Generation of Code

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer...

CVE-2025-65074: Improper Limitation of a Pathname to a Restricted Directory

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version...

CVE-2023-53883

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server...

CVE-2023-53883

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server...

CVE-2023-53888 Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files such as JavaScript and rename them to .php via the saveE and rename actions, then execute the...

CVE-2023-53883 Webedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server...

CVE-2023-53881

CVE-2023-53881 affects ReyeeOS 1.204.1614 and stems from unencrypted CWMP communications that enable a man-in-the-middle to intercept and manipulate device traffic. The vulnerability allows an attacker to impersonate a CWMP server and inject/execute arbitrary commands on Ruijie Reyee Cloud device...

GO-2025-4204 Mattermost Server does not properly restrict use of slash commands in github.com/mattermost/mattermost-server

Mattermost Server does not properly restrict use of slash commands in github.com/mattermost/mattermost-server...

CVE-2025-11393

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

CVE-2025-11393

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

CVE-2025-11393 Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

CVE-2025-11393

The CVE-2025-11393 entry concerns a misconfigured internal proxy in runtimes-inventory-rhel8-operator. The root cause is an internal proxy component that attaches the cluster’s main administrative credentials to any command, enabling a standard user to issue unauthorized commands with full cluste...

CVE-2025-11393 Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

CVE-2025-11393

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

📄 Docker Compose 2.40.3 Command Execution

Docker Compose version 2.40.3 proof of concept provider type PHP command execution exploit. ============================================================================================================================================= | Title : Docker Compose v 2.40.3 Provider Type PHP Command...

PT-2025-62947

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...