CVE-2025-3979

A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-password-ajax-1 of the component Password Change Handler. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely...

Malicious code in web3automation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 09a3fb2947bb8eaaf1e65033e8ccee659633669d5de0c0456b4c2e1680317dfb Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in ora3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9d9ff95457d63990b263b77b0f3468dcd63e0d1837c81843b2d4249706db48c7 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in websign (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25ea98e45fc0e99bfc731d77e2205bd14c901fc33ba6b8639b441b97739db0e2 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

MAL-2025-4271 Malicious code in web3wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e85209b2472e1db082515ccc7ca0b38a2e268379adc9547ac41af812aebc6fd7 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in walletrpcs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4b93b9b49f17c924bbca7ba78750257a7be53f8d48ad200a16dc5eb4e369a734 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in web3author (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5eac126109d648cac7a74217f0bc4b9e9bd0d07dc400924bf346f90b4b7ad9d Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

MAL-2025-4273 Malicious code in websign (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25ea98e45fc0e99bfc731d77e2205bd14c901fc33ba6b8639b441b97739db0e2 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in walletweb3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 03c7d45b1b392aae3891836f4e5083004be7ac61c0001ee649b834fefceb638d Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in web3evm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c2f7724a72031eda7b5c33755802a67784979e2a9459d83698b0637be68630b Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in web3wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e85209b2472e1db082515ccc7ca0b38a2e268379adc9547ac41af812aebc6fd7 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in web3yrpcs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 171ec4f4bbfb34688348ecdda292249487574c8fb28caf8467c0bbafb1563cb7 Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

MAL-2025-4260 Malicious code in walletweb3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 03c7d45b1b392aae3891836f4e5083004be7ac61c0001ee649b834fefceb638d Package contains just a function to send out data. It or a package sharing the same IoCs is used in a malicious GitHub project to exfiltrate crypto currency...

Malicious code in pretty-cli-logger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 94cd11911ce2a0937d9e56087ce9487db18da5bb20df7f1f8948f8356d65c31d Contains an obfuscated code that will download and run a remote script. At the time of the analysis, the remote URLs were delivering empty results --- Category...

MAL-2025-191801 Malicious code in neov (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c9e3f275318dc63c36dbc902dfd73c0b3aa4fa830d114c0833ed8d24258d9b0 Importing the module starts exfiltration of ".session" files, which appear to be used at least by one Telegram library...

MAL-2025-191849 Malicious code in qtpv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e0cfa610f53699fb3d04d6296bf28540a6162be41a7268566e999b070b517a6 Importing the module starts exfiltration of ".session" files, which appear to be used at least by one Telegram library...

RUSTSEC-2025-0063 Possible unsound public API

The public accessible struct SyncVec has a public safe method getunchecked. It accept a parameter index and used in the getunchecked without sufficient checks as mentioned here...

Possible unsound public API

The public accessible struct SyncVec has a public safe method getunchecked. It accept a parameter index and used in the getunchecked without sufficient checks as mentioned here...

Malicious code in ark-vmp-reverse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 28ac22df743a6a65eed4d1d25f66c0f3eb42c5235dc749a84162883d313bd415 During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...

`FormatContext` stream accessors can cause undefined behavior from safe code

Affected versions of stainlessffmpeg exposed several safe public methods on FormatContext that accepted a streamindex parameter and used it in unsafe pointer operations without checking whether the index was valid. These methods performed pointer arithmetic and dereferenced the resulting stream...