MAL-2025-188411 Malicious code in omega-big-zero-export-java (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6452494d4a91b262c8f8c973f098395e47d3fd525719d07e2c95a4915fae749b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in array-async-export-lambda-transpile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1c2bf7c9af1def9500860d07c8a0a69f31f3575833535c28b6b1d0715a5dd9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178882

Malicious code in float-encrypt-awk-dog-export npm...

EUVD-2025-176531

Malicious code in sandbox-table-async-void-export npm...

EUVD-2025-178957

Malicious code in export-zero-orchestrate-zero-compile npm...

Malicious code in unix-web-export-key-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d60838cb059ad234ae83460587017a2a0124557f3c34684256b7ffcf37b12d3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176305

Malicious code in socket-minify-export-catch-file npm...

Malicious code in omega-big-zero-export-java (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6452494d4a91b262c8f8c973f098395e47d3fd525719d07e2c95a4915fae749b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179141

Malicious code in encode-route-deserialize-eta-export npm...

EUVD-2025-178959

Malicious code in export-psi-zeta-upsilon-balance npm...

Malicious code in route-proxy-alpha-export-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82ed7ce7a196ba7ed5bc586cfdd287f1bcf2abf295da782560005753652fe5b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190183 Malicious code in void-uglify-warn-export-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a289220d5fd74e336a5702c92af3412df6ca9b1feea3e4847d79f92987df0c7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress plugin Order Export & Order Import for WooCommerce 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

CVE-2025-52186

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...

CVE-2025-52186

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...

WordPress plugin Welcart e-Commerce 安全漏洞

WordPress Welcart e-Commerce Plugin is an e-commerce plugin designed for WordPress to build and manage online stores. WordPress Welcart e-Commerce Plugin suffers from an unauthorized access vulnerability that stems from a lack of capability checking in the uscesexport operation, which can be...

CVE-2025-52186

Summary: CVE-2025-52186 affects Lichess Lila (before commit 11b4c0fb00f0ffd823246f839627005459c8f05c) with a Server-Side Request Forgery (SSRF) in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing a remote attacker to compel the ...

PT-2025-46842

🚨 CVE-2025-52186 Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to...

lila 安全漏洞

lila is an ad-free and open source chess server from Lichess Open Source. A security vulnerability exists in lila, which stems from the unvalidated direct passing of the players parameter in the game export API, which could lead to server-side request forgery...

PT-2025-46782

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.11.25 Description The Welcart e-Commerce plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the usces export action...