MAL-2025-85696 Malicious code in free_moth_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e87ab434b021c3e11c8134ede79284764139c2ee79d73628c91a55121ec70513 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12126

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access a...

Malicious code in wibowo-menjes85-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98ad4e6a93fb5695e059d975f20eaf6eb23857177e2474b7cc278c76d35f70e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76696 Malicious code in ade-gepuk24-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a1c7c3690dc172eebf056986bb8239907122b95fa1b2bcbb8a41bc686158186 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-78745 Malicious code in hendra-brengkes46-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b033538cc9dcbce79cdb4555e1f6cc506c5fd7d38826ba4b4f5398f4bfe2189 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-78822 Malicious code in historical_gazelle_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee5050e824f8a604d06085c4e7cc5fb19358f72117f9129d25702b612c746b3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76808 Malicious code in andi-bakwan53-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60b42ecbfca712e217480d6ec169cf43b5483fc7b96e5d25593c66aeb76d2037 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12126 The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access a...

CVE-2025-12126 The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access a...

Malicious code in yuni-gulai29-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eed7d13f55933f2779f879ea8e8f54f884eae5cf00d80cf745dbb6634d925a49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress The Total Book Project plugin <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Book Manipulation vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin The Total Book Project versions = 1.0...

Malicious code in increased-olive-cockroach (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9394fea9f851588f25f3695d77d0aba3dcb8ce1b0b8d0e60e055e1f8538f28b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69061 Malicious code in large-fuchsia-wasp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1062a47ed1f2271a0fdb57d02fb2c0e5cfaf128936e54cda914bcb6a251405 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-56945

Malicious code in tuti-nasisayur99-sluey npm...

MAL-2025-64703 Malicious code in oktafian-gepuk80-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bdbcb845bb5a80065804364342b7ab922887fd527b872c8aba40bd8a1ddbc2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tomi-mendut45-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1e76cf7cf4506abecc4453f731ce2139ca314e3ad18dec9e128f7675248b61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46528

Name of the Vulnerable Software and Affected Versions Lite XL versions prior to 2.1.9 Description Lite XL automatically executes the .lite project.lua file when opening a project directory without user confirmation. This file is designed for project configuration but can contain executable Lua...

Lite XL Arbitrary Code Execution via Project Module and Legacy system.exec Function

Overview Lite XL is a lightweight text editor derived from the lite project, written primarily in Lua and C. It supports Windows, Linux, and macOS, and is designed for extensibility through plugins and project‑specific modules. Description Two vulnerabilities were identified Lite XL: CVE-2025-121...

FairSketch Rise Ultimate Project Manager and CRM 跨站脚本漏洞

FairSketch Rise Ultimate Project Manager and CRM is a team management and customer relationship management system from FairSketch. A cross-site scripting vulnerability exists in FairSketch Rise Ultimate Project Manager and CRM version 3.8.1, which stems from insufficient validation of user input...

PT-2025-46529

Name of the Vulnerable Software and Affected Versions Lite XL versions 2.1.8 and prior Description Lite XL is a lightweight, cross-platform text editor written in Lua and C, designed for extensibility via plugins and project-specific modules. The application executes project-level Lua modules and...