Malicious code in dise-pkt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02da19d128c79fa9465ba506ff8f53abb3ef541a1da253174255be017c9fd97 The package dise-pkt was found to contain malicious code. Source: ghsa-malware 58b8c2811e173e83d76597b5cb08d80de79cbc72396b7ba7957ed6c15a6003a2 Any...

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

Summary A stored Cross-site Scripting XSS vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because...

Malicious code in magento-coding-standard-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 181566f148b6cac8ad613b2942849254b7a6968bbe5e16a9d009aaa8e4184b25 The package magento-coding-standard-eslint-plugin was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-206378

The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands...

Malicious code in internal-company-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa8dfa7267565b0ac4a94eb2d7fda38475a0ff412b196f5bdc842e73f9671455 The package internal-company-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-149 Malicious code in bnia-work (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78b12fa102dbd32d8d3a27c016f7b790124a3a73bdf1970768799e120183c30 The package bnia-work was found to contain malicious code. Source: ghsa-malware 2583fa3177342feb8975727c7ad5873d1a1e7bea2ce3ce445343aaa9a0b3459b Any...

PT-2026-4322

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw exists in Moodle that allows an attacker with access to the restore interface to trigger server-side execution of arbitrary code. This is caused by inadequate validation of restore inpu...

Arbitrary File Upload

net.mingsoft, ms-mcms is vulnerable to Arbitrary File Upload. The vulnerability is due to improper validation of uploaded files in the /ms/template/writeFileContent.do component, which allows an attacker to upload arbitrary files and potentially execute malicious code on the server...

CVE-2025-14611

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted...

MAL-2025-190765 Malicious code in capacitor-plugin-scgssigninwithgoogle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b87f31a2266c9633975e61214361882324c01060c614e04b15ac2e3a570fe6f The package capacitor-plugin-scgssigninwithgoogle was found to contain malicious code. Source: ghsa-malware...

RLSA-2025:20559 Low: shadow-utils security update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fixes: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 For...

MAL-2025-66551 Malicious code in tensor-fi-utils-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5e019daea1bdfd44c0cf583f38cd83ec5b2073b8b494e8ff91905e0b2f2f88e The package tensor-fi-utils-lib was found to contain malicious code. Source: ghsa-malware...

Malicious code in huangming-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53612bb1244997357931275dea1924a477215c7db7ab8297f2fead735926859e The package huangming-demo was found to contain malicious code. Source: ghsa-malware 503c69173f37b1e6d7f159b77bb5f5a3bb677dff293fb44f2a09038a31172fdb...

Malicious code in pensions-portals-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9025d84d3de41f55102920c25c5229e8104e159e23a3e943a7e955077ae61403 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48930 Malicious code in internallib_v691 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c5ee2345e934aa8329160e96eb7ef42bcb49e3a4ab1b782922617ff5139ffe5 The package internallibv691 was found to contain malicious code. Source: ghsa-malware 9528ffabfb8298ea419a8ed4f61cf56c726da851547cf6c27cfc9eca501181b...

CVE-2025-56450

Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the leadid parameter in the /l2s/api/selfcareLeadHistory endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulting in the execution of arbitrary SQL queries. T...

EUVD-2025-35180

Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the leadid parameter in the /l2s/api/selfcareLeadHistory endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulting in the execution of arbitrary SQL queries. T...

CVE-2025-56748

Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts...

MAL-2025-48256 Malicious code in mad-2.4.1.2.2.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56c6fc06b90e0e637cc8ef419f8a5844e909deaf9cc68f1c73e231757e6f214a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48039 Malicious code in rails-dom-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c71a0792e9dc0f14b43ce18d9e3c77d91946237916717b87a53222fb8fec287a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...