CampCodes School Fees Payment Management System SQL注入漏洞

School Fees Payment Management System is a tuition payment management system. The School Fees Payment Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter ID of the file...

PT-2025-47136

Name of the Vulnerable Software and Affected Versions Campcodes School Fees Payment Management System version 1.0 Description A weakness exists in Campcodes School Fees Payment Management System 1.0. Manipulation of the ID argument in the file '/ajax.php?action=delete fees' can lead to SQL...

EUVD-2025-175314

js-yaml has prototype pollution in merge...

SAP Business Connector Path Traversal Vulnerability

SAP Business Connector is a middleware from SAP, Germany. SAP Business Connector suffers from a path traversal vulnerability that can be exploited by an attacker to traverse directories on the system to read, write, overwrite, and delete arbitrary files on the host system...

Unspecified Vulnerability in Rockwell Automation Verve Asset Manager

Rockwell Automation Verve Asset Manager is a vendor-neutral OT endpoint management platform from Rockwell Automation USA. A security vulnerability exists in Rockwell Automation Verve Asset Manager that can be exploited by an attacker to read, update, and delete users via the API...

Improper Authorization

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Improper Authorization via the shareDeleteHandler function, which handles deletion requests based solely on the share hash, and does not verify whether the link.UserID...

Prototype Pollution

json-schema-editor-visual is vulnerable to Prototype Pollution. The vulnerability is due to insufficient validation of user-supplied input in the setData and deleteData functions, which allows an attacker to supply a crafted payload to inject or delete properties on Object.prototype, potentially...

MAL-2025-189885 Malicious code in test-on-spinner-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b3148fad24442f075c8707e11b5a5bd042be189f67c373b76d73ef2f18c289 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190471 Malicious code in zephyr-sadr-child-process-bootes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 146ecbbd3d8f2cb52b7a37a21f83f89b55640c24e6ac37ad73bd82f76b37752c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187547 Malicious code in iota-stub-wind-quick-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 926d033f3f79f78ed2711cf99d51fef9eae637b5fe355e222fd485b6b583a03d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hexo-duplex-xenos-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa1151ddade4025065c48113f1079d31279af60beb4be33b8708bba930be0e96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-ora-bootstrap-redshift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c94144702a359f66450437efd957137a56b3bce619a4b13ed508a050d09d69e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189813 Malicious code in tardigrade-virgo-hologram-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed42039e0d9b78e3cd59ebd720e24df16a2da59377b7c2fa98dada31223e78c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46851

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 4.1.1 Description js-yaml is a JavaScript YAML parser and dumper. A flaw exists where an attacker can alter the prototype of a parsed YAML document, leading to prototype pollution. This impacts users parsing untrusted...

MAL-2025-183286 Malicious code in kiudt-acavog-agaicua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd2c32753b0e6c6e359ed6876d318de6f17f3448b22f3d8d8c44a1b98826a20e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gocay-guga-visagoigojhi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ba24826b7bdb486c617ba88e6f1ebdd88b9cfe97c3c7642be9b5254ae3c6c24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184672 Malicious code in oliobc-uyg-ugiafabafiuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ecc8584bf3b41fcb355e5448692fafe6fa4210c6e37fd5778afe188b6c2c6f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64523 FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference IDOR vulnerability in the FileBrowser application's share deletion functionality. Th...

CVE-2025-64523 FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference IDOR vulnerability in the FileBrowser application's share deletion functionality. Th...

Malicious code in buis-manuis-boaad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9baca5bc99b77b896ef5cd9725ee8c4cfb0cb3448455fcf6fbff7ee36022af0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...