MAL-2025-3053 Malicious code in @hongfangze/random (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fa0305129280dcc792459235adfdc6136839cc43305dea19709f4970e9edc56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in checkoutsellerplatserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3ee286fa5544561b468d3ac01c5f000fbd2ffc8a1da55c3c4a5c2086b8b508d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2766 Malicious code in ilovingcats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bbf798857d246d05c268c052e1b394b82f9a62af9af62ff888c2ff03bb2d4f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in awesome-camera (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0049f4e25e583544388265d12d7760dde826982f89f8dae49f1e4e544f25bea9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-10210

An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL 4.4-005P may allow an authenticated network-based attacker to access data from the file system...

CVE-2024-10210 Path traversal in APROL Web Portal

An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL 4.4-005P may allow an authenticated network-based attacker to access data from the file system...

Malicious code in blockzie-save-svg-as-png (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12218d7a2fc38f96f07e686aaf4c4e5a76506d1dd69cdb9a90ab2e1346e36e0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2618 Malicious code in mind-meeting-assistant2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b5bc9454b761cdb738911b2168c5dae8d0507092d78f8112f71e1e9583957cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @agateh/solana-headless-adapter-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45f33c6ddd09439d626d2670e9e3fc38e407415cf98fb2f96b5f3d4d2dda52dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in architecture-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4282b66b0052ca80f8717181dbf7b0b94e88433b9e37f9ae718531960f9ddcbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

External Control of File Name or Path

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to External Control of File Name or Path via the restorerunbackup function. An attacker can write arbitrary data to arbitrary locations on the host server by controlling...

External Control of File Name or Path

Overview dbgpt is a DB-GPT is an experimental open-source project that uses localized GPT large models to interact with your data and environment. With this solution, you can beassured that there is no risk of data leakage, and your data is 100% private and secure. Affected versions of this packa...

External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between payment completion and order authorization, in...

Malicious code in tasks_mangement (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5af70a269afd5435306a85b902070f929d511d8855e369cc7c930a9dc50be50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between initial entry and payment completion, in...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2025-24996

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

Malicious code in smart-power-strip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1cc33c4b430e08bef89e4f67199d79002235613631ee986f8566d757fc14ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2379 Malicious code in elementor-editor-github-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72f60b6d3f909084d15e59acc80082db35f713c520dc29ff74ec2a79ceb33dcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...