CVE-2025-3920: Use of Hard-coded Password

A vulnerability was identified in SUR-FBD CMMS where hard-coded credentials were found within a compiled DLL file. These credentials correspond to a built-in administrative account of the software. An attacker with local access to the system or the application's installation directory could extra...

MAL-2025-4821 Malicious code in csvtool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8d9b3cadfd970dcf2392be22191a804e0b036f926807ed006b53d1542fb4ffc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mxc-jsbridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a080d6fa2cab7be94e152a7b621f7fd9d0ce62e7a726343e61bfbdf9e676e427 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in team-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf80f4dc8a828d3686ff11039376a7c45d8fcfc2424f006ac52ae528030a6547 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2019-17564

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

Malicious code in expo-sessoion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1f3216c0e974fd221139390340264f652810347ffd8e432f00d398412c0058 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3112 Malicious code in payoutsapiserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3138bfa1642d8493a633368a78332106126b9c776849c8525ab1fc491544935c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2791 Malicious code in transactions-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware add05b58536e55e9dfed5253cce6ec918d905362b9e9d30531d1a20dd39aca1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2679 Malicious code in internallib_v341 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 865726c0916807b2585990f7ea5edfefa1f6562a0ab9d319a37a67a1129338c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-12776

In langgenius/dify v0.10.1, the "/forgot-password/resets" endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application...

Malicious code in nicegirl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05d61fc6a090b764666270f91b100bc166fbb85c0227ac947e1bdc876bc8e6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1619 Malicious code in paypal-checkout-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8978fb3635d1339256e1aa90eab3f76ba33bad36f9a2ffd70d1f6fc7d60ccca8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1360 Malicious code in dzengi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8119e05e44d286deeecdba85e6cf45a95749db4907cb770fa9828949f1fc347c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12031 Malicious code in react-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 876139b096ddb1bf239489a666a6248e65ba5512906c207b40104c7efe2f1616 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11831 Malicious code in imran-downloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15461cfacc497cef71b31228912fc6fdb11bee1b51f4f93604e7efa6337b63c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-54126: Download of Code Without Integrity Check

This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicio...

Laravel 11.0 Cross Site Scripting

/! - VULNERABILITY: Cross Site Scripting Laravel version 11.0 - Authenticated Persistent XSS - GOOGLE DORK: inurl:.com/?q= - GOOGLE DORK: Site:.com/?q= - DATE: 2024-12-01 - SECURITY RESEARCHER: E1.Coders - VENDOR: LARAVEL https://laravel.com/ - SOFTWARE LINK:...

MAL-2024-8698 Malicious code in @diotoborg/voluptates-quos-esse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60b35b382b159eb60d9b16e6d879b84478d692e333b46f148956735b59499eb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8319 Malicious code in @diotoborg/ex-repellat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e30f0f24bcabf5b6bce5083307e9ba4d5f6aadd051592bbf5f715d455792651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-41107

The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...