CVE-2025-54411

CVE-2025-54411 affects Discourse prior to 3.5.0.beta8, where the welcome_banner.header.logged_in_members and the logged-in user name string can cause cross-site scripting (XSS). The underlying issue is in the welcome banner user name string, enabling XSS that may impact the user or allow an admin...

CVE-2025-54411 Discourse welcome banner user name XSS

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...

PT-2025-33751 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.5.0.beta8 Description: Discourse, an open-source discussion platform, contains a cross-site scripting XSS issue in the welcome banner user name string for logged-in users. This can affect the user or an...

Malicious code in xo-angular-shims-placeholder (npm)

The package xo-angular-shims-placeholder was found to contain malicious code...

MAL-2025-15468 Malicious code in bare-security-placeholder (npm)

The package bare-security-placeholder was found to contain malicious code...

MAL-2025-39897 Malicious code in xo-angular-shims-placeholder (npm)

The package xo-angular-shims-placeholder was found to contain malicious code...

Malicious code in bare-security-placeholder (npm)

The package bare-security-placeholder was found to contain malicious code...

Malicious Package

Overview vite-log-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @kodane/patch-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview storybook-core-core-server-presets-0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview @sys711/my-npx-tool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview react-stylizer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tailwind-theme-colors is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @ai0x1337/budoux-extension is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview db-connections-templates is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

TelegAI Insecure Direct Object Reference

TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to insecure direct object reference in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and cross site scripting payloads can be...

Malicious code in hero-tracing-placeholder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a3db765a0902f942989f3de02a4827acfff9c0c758c2feb9160b97fb2f6a921 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5501 Malicious code in hero-tracing-placeholder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a3db765a0902f942989f3de02a4827acfff9c0c758c2feb9160b97fb2f6a921 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the /types/appendvalue.go component. When a placeholder is directly preceded by a minus - and not separated by any whitespace, the library does not handle the particular case when a negative number is inserted for the...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the appendArg function in /pgdriver/format.go. When a placeholder is directly preceded by a minus - and not separated by any whitespace, the library does not handle the particular case when a negative number is inserte...