EUVD-2025-36853

Malicious code in transform-react-constant-elements npm...

Malicious code in transform-react-constant-elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d582d56f1f42a97702c2557fbfdcc90613da53d18adf5494b4f18c555c04398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview transform-react-constant-elements is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

EUVD-2023-60038

The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to extract...

The vulnerability of the AVReg software for creating audio/video recorders, related to the failure to take measures to neutralize special elements, allows a violator to execute arbitrary commands.

The vulnerability of the AVReg software for creating audio/video recorders is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

libxml: Type confusion leads to Denial of service (DoS)

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined...

Aksis Netty ERP SQL注入漏洞

Aksis Netty ERP is an enterprise resource planning software from Aksis Turkey. An SQL injection vulnerability exists in Aksis Netty ERP versions prior to V.1.1000, which stems from improper neutralization of special elements and can lead to SQL injection attacks...

CVE-2025-49939: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through = 2.7.8...

Everyone Needs AIR: An Agnostic Incident Reporting Framework for Cybersecurity in Operational Technology

Operational technology OT networks are increasingly coupled with information technology IT, expanding the attack surface and complicating incident response. Although OT standards emphasise incident reporting and evidence preservation, they do not specify what data to capture during an incident,...

MediaWiki - Springboard Extension 安全漏洞

MediaWiki - Springboard Extension is an open source navigation extension for MediaWiki. A security vulnerability exists in the master version of MediaWiki - Springboard Extension, which stems from improper neutralization of special elements in commands and could lead to a command injection attack...

The vulnerability of the SerialInterfaceService.exe utility on Moxa industrial computers allows a hacker to increase their privileges.

The vulnerability of the SerialInterfaceService.exe utility on Moxa industrial computers is related to the absence of quotation marks in the code for elements or search paths. Exploiting this vulnerability can allow attackers to enhance their privileges by sending a specially created malicious fi...

CVE-2025-47902

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5...

The vulnerability of the platform for data collection, monitoring, and analysis in industrial automation and industrial security systems, Radiflow iSAP Smart Collector. This vulnerability arises due to the failure to take measures to neutralize special elements used in the operating system’s command set, allowing a perpetrator to execute arbitrary commands.

The vulnerability of the data collection, monitoring, and analysis platform in industrial automation and industrial security systems, Radiflow iSAP Smart Collector, exists due to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this...

Malicious Package

Overview stack-ui-elements is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin TheGem Theme Elements for WPBakery versions = 5.10.5.1...

Juniper Networks Junos OS Evolved Operating System Command Injection Vulnerability

Juniper Networks Junos OS Evolved is an upgraded version of Juniper Networks' Junos OS. Juniper Networks Junos OS Evolved suffers from an operating system command injection vulnerability that stems from improper handling of special elements, which could be exploited by an attacker to cause an OS...

EUVD-2025-34190

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure allows Blind SQL Injection.This issue affects Winsure: through Version dated 21.08.2025...

CVE-2025-0636

EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution...

CVE-2025-11731

A flaw was found in the exsltFuncResultComp function of libxslt, which handles EXSLT elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads...

CVE-2025-11731

A flaw was found in the exsltFuncResultComp function of libxslt, which handles EXSLT elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads...