HSEC-2023-0014 Arbitrary file write is possible when using PDF output or --extract-media with untrusted input

Arbitrary file write is possible when using PDF output or --extract-media with untrusted input Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafted image element in the input when generating files using the --extract-media option ...

CVE-2025-11981: Improper Neutralization of Special Elements used in an SQL Command

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and including, 2.2.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2025-179564

Malicious code in cors-relay-mini-css-extract-plugin-winston npm...

EUVD-2025-180480

Malicious code in airbnb-mini-css-extract-plugin-centauri-soap npm...

EUVD-2025-180399

Malicious code in apex-electron-protractor-mini-css-extract-plugin npm...

EUVD-2025-178484

Malicious code in hydra-hawkingradiation-markdownlint-mini-css-extract-plugin npm...

EUVD-2025-177831

Malicious code in mini-css-extract-plugin-sass-loader-rigel-koa npm...

Malicious code in hydrogeology-chariklo-pulsar-mini-css-extract-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d514e86e9a193b5e01631ae67c92d3d0e92c33b1e9cb062f76dee9edaf4a7576 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176450

Malicious code in seismology-jabbah-exosphere-mini-css-extract-plugin npm...

EUVD-2025-177833

Malicious code in mini-css-extract-plugin-paleoecology-redis-release-it npm...

EUVD-2025-177835

Malicious code in mini-css-extract-plugin-meissa-chai-ganymede npm...

Malicious code in cors-relay-mini-css-extract-plugin-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b5d4138a7e858f7a94edc8c60c8746ad366a44ba1f9fafa3a7461ac2cca612 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190228 Malicious code in wasat-betelgeuse-mini-css-extract-plugin-cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72c3967bfa61a9dcf238d33c4284ce2f1f41d6b3f850a019d161f7672cf5834 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185408 Malicious code in airbnb-mini-css-extract-plugin-centauri-soap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 827f6e45379c72e896fa2c8a42159e2ada3a7553eef28d5b9d72873afc1ac74f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188308 Malicious code in node-config-mini-css-extract-plugin-bellatrix-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a0f4cb1363923700e234a126ba9afc3eb8cefa5fbc782a1ed68bce1e6c9fdf7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179228

Malicious code in dynamo-mini-css-extract-plugin-cosmicsilence-frontend npm...

EUVD-2025-175468

Malicious code in xo-mini-css-extract-plugin-vega-koa npm...

EUVD-2025-177840

Malicious code in middleware-mini-css-extract-plugin-ignite-json npm...

EUVD-2025-177832

Malicious code in mini-css-extract-plugin-radiant-axios-sirius npm...

Malicious code in apex-electron-protractor-mini-css-extract-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 779cc6c8c43d7168deaf2cb7d9acad1a4f866432756bf35644ea6160de97ecfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...