Malicious code in custom-get-org-chart (npm)

The package custom-get-org-chart was found to contain malicious code...

MAL-2025-21365 Malicious code in get-start-synpress (npm)

The package get-start-synpress was found to contain malicious code...

Malicious code in core-get-started (npm)

The package core-get-started was found to contain malicious code...

Malicious code in get-stats-from-planning-file (npm)

The package get-stats-from-planning-file was found to contain malicious code...

MAL-2025-21363 Malicious code in get-ark-survival-ancient-amber-generator (npm)

The package get-ark-survival-ancient-amber-generator was found to contain malicious code...

MAL-2025-17833 Malicious code in custom-get-org-chart (npm)

The package custom-get-org-chart was found to contain malicious code...

MAL-2025-21366 Malicious code in get-stats-from-planning-file (npm)

The package get-stats-from-planning-file was found to contain malicious code...

MAL-2025-22725 Malicious code in how-to-get-followers-on-instagram-without-following (npm)

The package how-to-get-followers-on-instagram-without-following was found to contain malicious code...

MAL-2025-37903 Malicious code in updated-tricks-roblox-robux-generator-2023-get-verify_wrhzdu (npm)

The package updated-tricks-roblox-robux-generator-2023-get-verifywrhzdu was found to contain malicious code...

CVE-2025-8949

A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function getpingappstat of the file pingresponse.cgi of the component httpd. The manipulation of the argument pingipaddr leads to stack-based buffer overflow. The attack can be launched remotely. The...

CVE-2025-8949

CVE-2025-8949 concerns a stack-based buffer overflow in D-Link DIR-825 v2.10, affecting the httpd component’s ping_response.cgi function get_ping_app_stat. The vulnerability stems from unsafely handling the ping_ipaddr argument, enabling a remote attacker to overflow a stack buffer. Public disclo...

SUSE CVE-2025-55159

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the getdisjointmut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has...

CVE-2025-43983

The KuWFi CPF908-CP5 WiFi router running firmware version WEB5.0_LCD_20210125 is affected by multiple unauthenticated access control vulnerabilities located within goform/goform_set_cmd_process and goform/goform_get_cmd_process. These flaws allow an unauthenticated attacker to perform actions suc...

Fedora 42 : glib2 (2025-16acfe9927)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-16acfe9927 advisory. Resolve CVE-2025-7039 Buffer Under-read on GLib through glib/gfileutils.c via gettmpfile with several other bug fixes. Tenable has extracted the preceding...

Information Exposure

Overview omero-web is an OMERO.web Affected versions of this package are vulnerable to Information Exposure via the getGuestConnection function in the webadmin/views.py file. An attacker can obtain unnecessary user information by triggering error messages during password reset attempts. Workaroun...

CVE-2025-6184

CVE-2025-6184 : Tutor LMS Pro (WordPress)

CVE-2025-7384 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the getleaddetail function. This makes it possible for unauthenticated attackers to inject a P...

CVE-2011-10017: Improper Neutralization of Special Elements used in an OS Command

Snort Report versions 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no...

PT-2025-32965

Name of the Vulnerable Software and Affected Versions: Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions up to and including 1.4.3 Description: The plugin is susceptible to a PHP Object Injection due to the deserialization of untrusted input within the get lead...

CVE-2025-55167 WeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/funcionario/dependenteremover.php endpoint, specifically in the iddependente parameter. This vulnerability...