EUVD-2025-113362

Malicious code in fusion-xerxes-comet-auth npm...

Malicious code in testcafe-fusion-apex-pyxis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aee658c579170c5164ae1036a3feeee6271e0ec8302b8fdf93c7c1becbe9e34c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-115784

Malicious code in callback-webdriver-mocha-apex-fusion npm...

Malicious code in tailwindcss-oberon-fusion-virgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 232e75b055fc6230a800b89b059a9525beee5af58139c6d0f9ac05f8229b7a48 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121550

Malicious code in superagent-ceres-elektra-fusion npm...

EUVD-2025-113361

Malicious code in fusion-zenobia-apollo-ariel npm...

EUVD-2025-113377

Malicious code in fusion-indus-atlas-iota npm...

MAL-2025-142728 Malicious code in fusion-cygnus-scripts-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0da0f3ed82a6802e1032006ffa7496f3444868266e937a6df6c74d62d391362d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142731 Malicious code in fusion-element-ui-browserify-odin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc3ceb40b6042bd1dc98340857c23502250ba04d1b033674c17a6d37bb7559a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142161 Malicious code in eris-auth-fusion-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63c74e6c4177a2be27c16708c819a8e4889de935df4620a23f9b07e19498a0d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142727 Malicious code in fusion-callisto-parcel-nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78094ec84b44c653fb466d59da99ced3eb3102b8ca8e13b0bef3f006f795826d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148449 Malicious code in tailwindcss-oberon-fusion-virgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 232e75b055fc6230a800b89b059a9525beee5af58139c6d0f9ac05f8229b7a48 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142720 Malicious code in fusion-apollo-style-loader-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e697bff033a44314f01620f35bf49c622e6ce1d0f971103c8b1871fda65d10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2023-53690

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views th...

CVE-2018-25119

Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting XSS via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2023-53689

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...

CVE-2023-7312

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affecte...

CVE-2017-20209

Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting XSS via the Users and Servers pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2025-34249

Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication 2FA implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try...

CVE-2025-34269

Nagios Fusion versions prior to R2.1 contain a vulnerability due to the application not requiring re-authentication or session rotation when a user has enabled two-factor authentication 2FA. As a result, an adversary who has obtained a valid session could continue using the active session after t...