Malicious code in schoolhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 207beec4a342cd3a46c5a21ea6b76c3e84e88374f40a76b6c5761859a76ea2c4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2025-12721

g-FFL Cockpit = 1.7.1 - Esposizione di informazioni non autenticata Il plugin g-FFL Cockpit non implementa controlli di autorizzazione adeguati sull'endpoint REST API serverstatus, consentendo a utenti non autenticati di accedere a informazioni sensibili sulla configurazione del server,...

CVE-2023-49367

CVE-2023-49367 - Exposição de Dados Sensíveis Exposição de Dados Sensíveis no Painel Web da Impressora Kyocera Fornecedor: Kyocera Corporation Versões Afetadas: Command Center RX - EXOSYS M5521cdn Descrição Após conectar-se ao livro de endereços da interface Kyocera, solicitações de teste para sm...

CVE-2025-53694

CVE-2025-53694: Divulgação de Informações na API ItemService com um usuário anônimo restrito, levando à exposição de chaves de cache usando uma abordagem de força bruta A API ItemService, acessível em /sitecore/shell/api/sitecore/ItemService/GetChildren, permite que usuários não autenticados...

CVE-2025-55182-react2shell

CVE-2025-55182: Rilevatore di Componenti React Server RSC Esposti Questo repository contiene un template Nuclei per rilevare l'esposizione di Componenti React Server associata a CVE-2025-55182. La vulnerabilità interessa applicazioni costruite con React/Next.js dove il livello di negoziazione RSC...

CVE-2025-25163-Nuclei-Template

قالب Nuclei لـ CVE-2025-25163 🚀 نظرة عامة يحتوي هذا المستودع على قالب Nuclei مصمم خصيصًا لاكتشاف ثغرة Path Traversal CVE-2025-25163 في إضافة Plugin A/B Image Optimizer لووردبريس. تشكل هذه الثغرة خطرًا أمنيًا حرجًا، حيث تسمح بالوصول غير المصرح به إلى ملفات الخادم الحساسة. 🔍 وصف الثغرة CVE-2025-251...

rapid-reset-check

Rapid Reset Check rapid-reset-check é um pequeno CLI em Go para inventariar rapidamente endpoints HTTPS que expõem HTTP/2 e, portanto, precisam de uma revisão de mitigação para CVE-2023-44487. O scanner é deliberadamente não exploratório. Ele resolve cada alvo, abre uma conexão TLS com verificaçã...

HTC

Hack The CCTV Credenziali DVR esposte | CVE-2018-9995 | Nome utente CCTV divulgato per ottenere accesso di login Come Usare? root@kitploit: Apri https://www.zoomeye.org/ Cerca questa parola chiave '/login.rsp' Attendi per ottenere IP e Porta $ python3 thecctv.py Maggiori Informazioni OS|...

CVE-2026-56707

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

EUVD-2026-65219

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76839 Grav before 2.0.16 Information Disclosure via offsetGet

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76839

Grav before 2.0.16 is affected by an information disclosure vulnerability in its sandboxed Twig templates. The allow-listed offsetGet() and offsetexists() methods lack field filtering on User objects , permitting attackers with page-edit permissions to extract hashed passwords and 2FA secrets , e...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders. An attacker with page-content edit access (low privilege) can bypass the config_denied_paths restrictions by using dot notation in Twig templates, exposing raw configuration values inclu...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

EUVD-2026-65193

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-65175

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2017-12637_SAP-NetWeaver-URL-Traversal

CVE-2017-12637SAP-NetWeaver-URL-Traversal Scanner LFI proof-of-concept: rilevamento automatico delle esposizioni di /etc/passwd tramite directory traversal e corrispondenza regex. root@kitploit: Scanner LFI Un proof-of-concept Python leggero per scansionare host target per vulnerabilità di Local...

PT-2026-81860

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

APSB26-124 : Security update available for Adobe Illustrator

Adobe has released an update for Adobe Illustrator. This update resolves an important vulnerability that could result in memory exposure...

VulnCheck KEV: CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...