EUVD-2025-202968

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'suppthandledeletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2025-13987

CVE-2025-13987 affects the WordPress plugin Purchase and Expense Manager up to version 1.1.2. The issue is a Cross-Site Request Forgery (CSRF) due to missing nonce validation in the function sup_pt_handle_deletion . This allows unauthenticated attackers to delete arbitrary purchase records by tri...

CVE-2025-13987 Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'suppthandledeletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

WordPress plugin Purchase and Expense Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A cross-site request...

PT-2025-50841

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'sup pt handle deletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

WordPress Purchase and Expense Manager plugin <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Purchase Record Deletion vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Purchase and Expense Manager versions = 1.1.2...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-198841

Malicious code in capacitor-plugin-purchase npm...

Malicious code in capacitor-plugin-purchase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ff438ebca922d9d6cb6a8a96700003065dbfc0ed65a5984edec2d5f5d37751 The package capacitor-plugin-purchase was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190836 Malicious code in capacitor-plugin-purchase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ff438ebca922d9d6cb6a8a96700003065dbfc0ed65a5984edec2d5f5d37751 The package capacitor-plugin-purchase was found to contain malicious code. Source: ghsa-malware...

Malicious code in capacitor-purchase-history (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ef54df7bce3add5d55de2f91510b75ffc757c47626010c4f44b59ef8f08242c The package capacitor-purchase-history was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198736

Malicious code in capacitor-purchase-history npm...

MAL-2025-190766 Malicious code in capacitor-purchase-history (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ef54df7bce3add5d55de2f91510b75ffc757c47626010c4f44b59ef8f08242c The package capacitor-purchase-history was found to contain malicious code. Source: ghsa-malware...

PT-2025-47284

Name of the Vulnerable Software and Affected Versions Live sales notification for WooCommerce plugin for WordPress versions prior to 2.3.39 Description The Live sales notification for WooCommerce plugin for WordPress is affected by a missing authorization issue. The getOrders function does not ha...

Malicious code in post-purchase-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-49731 Malicious code in post-purchase-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

EUVD-2025-38729

Malicious code in post-purchase-frontend npm...

EUVD-2025-37929

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase...

CVE-2025-60503

A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...

CVE-2025-60503

A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...