MAL-2025-3679 Malicious code in bitpay-push-notification-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff585151e0d20f0a3114337d0053b2fa14d0b74c758b8d3a60f9645028bba9f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

"Cannot Complete your request" during enumeration for DUO OAuth in 2 factor setup

Getting " Cannot complete your request" after duo push is successfully sent. In the url tab, we could see the client connection being pointed to storefront successfully...

CVE-2025-32546

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through = 1.5.3...

CVE-2025-32546

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through = 1.5.3...

CVE-2025-32546: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through = 1.5.3...

WordPress plugin All push notification for WP 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-32547

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects All push notification for WP: from n/a through = 1.5.3...

CVE-2025-32547

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects All push notification for WP: from n/a through = 1.5.3...

PT-2025-15786 · WordPress · Push Notification For Wp

Name of the Vulnerable Software and Affected Versions: All push notification for WP versions 1.5.3 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Blind SQL Injection. This means an attacker could potentially force a user to perfor...

WordPress plugin All push notification for WP 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-32547: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects All push notification for WP: from n/a through = 1.5.3...

PT-2025-12008

Name of the Vulnerable Software and Affected Versions Passbeemedia Web Push Notification WordPress plugin versions 1.0.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users, such as administrators. This occurs because th...

CVE-2024-13877: Improper Neutralization of Input During Web Page Generation

The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

What Happens When Push Notifications Go Malicious?

A Storm of Scams Awaits!...

CVE-2025-25092

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through = 1.5.3...

WordPress Passbeemedia Web Push Notification plugin <= 1.0.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Passbeemedia Web Push Notification versions = 1.0.0...

CVE-2025-25092

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through = 1.5.3...

CVE-2025-25092

CVE-2025-25092 is a reflected XSS in the WordPress plugin “All push notification for WP” (affecting versions up to 1.5.3). The issue arises from improper input neutralization during web-page generation, enabling reflected malicious input to be executed in a victim’s browser. Reported CVSSv3.1 bas...

CVE-2025-25092 WordPress All push notification for WP plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through = 1.5.3...

WordPress plugin All push notification for WP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...