350 matches found
Malicious code in vn-hrm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d7e7500ba0af4e9b2c0354a3820e7c28cc50ed3e9092db9e4c3c3cba3958234 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2022-29759
Malicious code in bioql PyPI...
EUVD-2025-31024
Malicious code in bioql PyPI...
EUVD-2024-34700
Malicious code in bioql PyPI...
EUVD-2025-28045
Malicious code in bioql PyPI...
EUVD-2024-40144
Malicious code in bioql PyPI...
EUVD-2022-29760
Malicious code in bioql PyPI...
EUVD-2022-29761
Malicious code in bioql PyPI...
CVE-2025-48867
Horilla is a free and open source Human Resource Management System HRMS. A stored cross-site scripting XSS vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in the Project and Task modules. These payloads...
CVE-2025-48867
CVE-2025-48867 describes a stored cross-site scripting (XSS) vulnerability in Horilla HRM 1.3.0. The issue allows authenticated admin/privileged users to inject malicious JavaScript into multiple fields in the Project and Task modules; payloads are stored in the database and execute when viewed b...
CVE-2025-48867 Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules
Horilla is a free and open source Human Resource Management System HRMS. A stored cross-site scripting XSS vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in the Project and Task modules. These payloads...
CVE-2025-48867: Improper Neutralization of Input During Web Page Generation
Horilla is a free and open source Human Resource Management System HRMS. A stored cross-site scripting XSS vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in the Project and Task modules. These payloads...
CVE-2025-57204: Improper Neutralization of Input During Web Page Generation
Stocky POS with Inventory Management & HRM ui-lib version 5.0 is affected by a Stored Cross-Site Scripting XSS vulnerability within the Products module available to authenticated users. The vulnerability resides in the product name parameter submitted to the product-creation endpoint via a standa...
CVE-2025-48784
A missing authorization vulnerability in Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to modify system settings without prior authorization...
CVE-2025-46455
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-management-system allows SQL Injection.This issue affects WP HRM LITE: from n/a through = 1.1...
CVE-2025-46455
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-management-system allows SQL Injection.This issue affects WP HRM LITE: from n/a through = 1.1...
CVE-2025-46455 WordPress WP HRM LITE plugin <= 1.1 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-management-system allows SQL Injection.This issue affects WP HRM LITE: from n/a through = 1.1...
CVE-2025-46455 WordPress WP HRM LITE <= 1.1 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in IndigoThemes WP HRM LITE allows SQL Injection. This issue affects WP HRM LITE: from n/a through 1.1...
CVE-2025-46455
CVE-2025-46455 corresponds to an SQL Injection in IndigoThemes WordPress WP HRM LITE (<= 1.1). The vulnerability arises from improper neutralization of input in WP HRM LITE, affecting versions up to 1.1. Base CVSSv3.1 score is 9.3 (CRITICAL) with network attack vector, no privileges required, ...
CVE-2024-48072
Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction=getFieldTriggerValue==HrmResourceManager=1%3d1=1=%3d=1...