EUVD-2025-122963

Malicious code in quasar-remark-csrf-chai npm...

EUVD-2025-113859

Malicious code in eslint-terser-webpack-plugin-nightwatch-csrf npm...

EUVD-2025-122663

Malicious code in repository-canopus-csrf-stop npm...

EUVD-2025-120348

Malicious code in writable-uninstall-jasmine-csrf npm...

MAL-2025-140764 Malicious code in chromedriver-csrf-ariel-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3b7bcbb5c91af68f2226ee73e0f82d0975d4f5cb57c97087eab99276a369e04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143358 Malicious code in html-webpack-plugin-csrf-link-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 922ca18a44731d301d1740519b17256d39a472601f460a03933bf194565d2642 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123359

Malicious code in process-parcel-pino-pretty-csrf npm...

EUVD-2025-116579

Malicious code in apollo-non-blocking-local-csrf npm...

EUVD-2025-113937

Malicious code in eris-firebase-uglify-js-csrf npm...

EUVD-2025-114120

Malicious code in eleventy-aurora-csrf-semantic-release npm...

EUVD-2025-114814

Malicious code in csrf-pulsar-config-centaurus npm...

EUVD-2025-114242

Malicious code in elara-centauri-csrf-unuk npm...

EUVD-2025-116558

Malicious code in aquarius-perseus-cross-env-csrf npm...

EUVD-2025-111213

Malicious code in meteor-chalk-csrf-sagitta npm...

EUVD-2025-120625

Malicious code in wasat-vuepress-quantum-csrf npm...

EUVD-2025-116727

Malicious code in andromeda-csrf-got-tool npm...

CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

CVE-2025-12901

The CVE-2025-12901 entry concerns the WordPress plugin Asgaros Forum. Reports across multiple sources confirm a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 3.2.1 caused by missing nonce validation in the set_subscription_level() function, enabling unauthenticated attacke...

WordPress Asgaros Forum plugin <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update vulnerability

Cross-Site Request Forgery to Subscription Settings Update vulnerability discovered by Brian Mungai in WordPress Plugin Asgaros Forum versions = 3.2.1...