MAL-2025-66955 Malicious code in bewildered-black-magpie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b88694bd596902a819757c99cd9716dc39c7efe1bdb23496e6a76ab1425a23e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68986 Malicious code in isolated-bronze-jackal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6235956f79263662ff129bf606e13aa3be29e48587b62990b39121fd5ecceba5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in amused-amber-partridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe92f325cb2f8bba585932c37dc597908665232e0bb19aa3a0e58f25bd93b49d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadhil-mangut38-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96fe5ad1e7fd741699e8a86dc25d4028da1eba3b81d707b7bad9afa9599259c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiki-sego51-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba2e337197c1ad515d762d394ab3b747664b5c33aabec70bf542cb3e78ec41f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66436 Malicious code in zain-tahu3-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90be907761b961f32e2c680ed27fe926f4ec3c464cd87f0dbdf5393ccb0df05c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46325

Name of the Vulnerable Software and Affected Versions The Classified Listing – AI-Powered Classified ads & Business Directory Plugin versions up to and including 5.2.0 Description The Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress is susceptible to...

PT-2025-46376

Name of the Vulnerable Software and Affected Versions NVIDIA AIStore affected versions not specified Description NVIDIA AIStore contains a security flaw in the Authentication AuthN component. A successful exploit of this issue may lead to escalation of privileges, information disclosure, and data...

PT-2025-46265

Name of the Vulnerable Software and Affected Versions Shelf Planner plugin for WordPress versions prior to 2.7.1 Description The Shelf Planner plugin for WordPress is susceptible to unauthorized data modification. This is due to a lack of proper capability checks on several REST API endpoints. An...

WordPress plugin Classified Listing – AI-Powered Classified ads & Business Directory Plugin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin Private Google Calendars 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin Shelf Planner 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-46225

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal affected versions not specified Description An unauthenticated attacker can inject JNDI environment properties or provide a URL during JNDI lookup operations. This could allow access to an unintended JNDI...

CVE-2025-64519

TorrentPier (PHP) up to version 2.8.8 is affected by an authenticated SQL injection in the moderator control panel (modcp.php) via the topic_id parameter. The root cause is unsafely embedding the $topic_id input into an SQL query, enabling an authenticated moderator to execute arbitrary SQL with ...

MAL-2025-61588 Malicious code in visible_chipmunk_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0caf3d2d1f77a2a2f2f20c2307cfe98633621d436e12037002eaddb908c6c3f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in marxist_dormouse_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8764397394fd43c7999877b37f280037e0e1d23663abc203df7501ba76e7355d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tense_cow_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6e3f7ec1f681d8091eb38a2cd0d511f011487a59e42ba1f394f2e973d0a9609 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dewi-jengkol75-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c5b07d012f2a801c06befee49452fccb79833b7364d660d9deb1b684e5c24a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indah-sate90-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 805ba353fcd29c32c89d41944babe56ac7507e7e63bf7d6fddecb3c805031da8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-mie66-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7867809bb5bb240d4596c8b8ac570c35472300da121cbb91ed77bb3b72f3388c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...