EUVD-2025-115300

Malicious code in cli-quantum-graphql-phoebe npm...

Malicious code in process-mysql-graphql-achernar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce30421baf221f5039852b56fa71beb90736340eb15021cdb3e1155efa5bad6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in promise-rimraf-supervisor-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59479e17cbe88afc81a1c8a65d70256bb17e84aa6391bdafb3acfc2ccd62424d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113099

Malicious code in graphql-vuepress-husky-bellatrix npm...

EUVD-2025-112970

Malicious code in halley-graphql-europa-eridanus npm...

MAL-2025-142997 Malicious code in graphql-chai-schema-elara (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8815d1a4d4f17193b365dff9a9095f12e31e182c8b4d9189ceeeb9f15874d46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148896 Malicious code in ultra-graphql-xo-deimos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb7fe9788fc5f85a480b8336fcd4cf110708d0c9494d6b9eb531def9a0c2053f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139793 Malicious code in await-altair-got-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a660fc5e738c8d00b5f3881d89852c995e28e12b38ece3a1ead965d679ec57a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146031 Malicious code in pegasus-graphql-playwright-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9485849dcf43ce232720e15f229be2925398be484ea117e2cc67c5e107784b5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148075 Malicious code in solis-graphql-figures-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45612d2418157df1b47f3b420231aaaf83a4363bb4a5c2aa3eed9c095e71deb0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141276 Malicious code in cross-env-yakutsk-octans-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ec258cbc55d95a4aa0c35968e62956f226510e7535d823debd9ec5c976ed91e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144112 Malicious code in karma-kronos-protractor-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2613bf60636387829ca0905577e948da2806d337f061920b907c9fc948430379 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-graphql-levels-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20526f5014eee97ee2e57fd6f52681ed6681877adc4ebeefb396c9d8ff23adea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in halley-graphql-miranda-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 294a60f8bc8353187fcdc637762aa04ae29fba73de6a28272a0e39cffb15dd41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site scripting issue in k8s proxy impacts GitLab CE/EE Incorrect Authorization issue in workflows impacts GitLab EE Information Disclosure issue in GraphQL subscriptions impacts GitLab CE/EE Information Disclosure issue in access control impacts GitLab CE/EE Prompt Injection...

CVE-2025-64493

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493

In SuiteCRM versions 8.6.0–8.9.0, an authenticated, blind (time-based) SQL injection exists in the appMetadata operation of the GraphQL API, allowing extraction of arbitrary data without admin access. Affected component: GraphQL API, operation appMetadata. Root cause: improper handling/validation...

SuiteCRM SQL注入漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. A SQL injection vulnerability exists in SuiteCRM versions 8.6.0 through 8.9.0, which stems from an authenticated time-based SQL injection in the appMetadata-operation of the GraphQL-API, which could lead to arbitrary da...