CVE-2025-47286 Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on i...

MAL-2025-60855 Malicious code in mild_magpie_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 082fde5eea7cea7279678d1050364a333a8641fdaa12e6d715b8328b97cdd08b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60937 Malicious code in net_magpie_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ea66672534852503e12944d4b5caabdfda8bb0a9090c0f874613b41441e2b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in appropriate_ladybug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 548e6d038f63220eea41978c8f802ca6c7a8cf2c2e034b9ebb9018110d4d5909 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57107 Malicious code in joni-papeda71-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d80db9ea43b6ebce376284a2bb1aa2fe31b5004ddf66ed64b8cc088b4943da5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-serimuka48-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dfbe0ad107df687402b3e36c280f85508944d4aa7ef81b6ee9e1fa6f4c1e43a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in galih-tahu69-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11e8266cedc06999b057169fc333689334a98fc338328939d8a31b77840004c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-55436 Malicious code in budi-kemplang26-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7012109ea81e7e5699af8000c17146371647fabea8c87d09d8d1b54f32b8b701 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52022 Malicious code in hadianto-kue21-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68536448e252b124267f54601fddd284553bcb629a828bd21db6109d399f435c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Combodo iTop 跨站脚本漏洞

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for the daily operation of IT environments. The program provides incident management, configuration management and problem management. A cross-site scripting vulnerability exists in Combodo iT...

PT-2025-46184

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2 Description Combodo iTop, a web-based IT service management tool, is susceptible to cross-site scripting when a dashboard is edited through an AJAX call. This allows fo...

CVE-2025-62802

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most...

📄 RiteCMS 3.1.0 Remote Code Execution

RiteCMS version 3.1.0 suffers from an authenticated remote code execution vulnerability. Exploit Title: RiteCMS 3.1.0 - Authenticated Remote Code Execution RCE Date: 2025-10-26 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/handylulu/RiteCMS Software Link:...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2025-6639 Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments

The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutorassignmentsubmit...

The vulnerability of the fix_ipv6checksums() function in the PCAP-file editor tool tcprewrite, a utility for editing and playing back PCAP files. This vulnerability allows an attacker to cause a service failure.

The vulnerability of the fixipv6checksums function in the PCAP-file editor tool tcprewrite, as well as in the PCAP-file editing and playback tool Tcpreplay, is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

Cross-site Scripting (XSS)

Overview ezsystems/ezplatform-admin-ui is a package that is part of the eZ Platform Admin UI Bundle. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the reschedule/cancel-schedule modal in the back office interface. An attacker can execute arbitrary scripts by...

CVE-2025-59428 EspoCRM allows arbitrary user creation via stored SVG injection and CSRF

EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit...

vim: Vim path traversial

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive...

CVE-2025-62243

Insecure direct object reference IDOR vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the...