EUVD-2025-3307

Malicious code in bioql PyPI...

sinatra

This is a Sinatra repository, a DSL for creating web applications in Ruby with minimal effort. The repository contains various files, including a .github/workflows/test.yml file that defines a GitHub Actions workflow for testing, and a Gemfile that lists dependencies for the project. The Gemfile...

MaraDNS_1

This is a repository for MaraDNS, a small open-source DNS server. The repository contains various files and scripts for building and testing MaraDNS, including a Dockerfile for creating a Docker image to test installing MaraDNS on a fresh Ubuntu 22.04 virtual machine. The repository includes a...

Linux Distros Unpatched Vulnerability : CVE-2022-24828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call VcsDriver::getFileContent can have a code injection...

Linux Distros Unpatched Vulnerability : CVE-2022-4092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to...

MAL-2025-191913 Malicious code in tronpropy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7afae45886ed971d16bb4ec51b03a8b3ffb6c75d32586cdcd7b4b15895699e7f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2025-191912 Malicious code in tronlinknet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 61d63a54e62ad11fa6d3420324a6cd948450337ae9faf28d8372994c92c8f294 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in tronlinknet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 61d63a54e62ad11fa6d3420324a6cd948450337ae9faf28d8372994c92c8f294 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

WordPress Plugin README Parser plugin <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via target Parameter vulnerability discovered by muhammad yudha in WordPress Plugin Plugin README Parser versions = 1.3.15...

CVE-2025-8720

The Plugin README Parser plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘target’ parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-8720 Plugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter

The Plugin README Parser plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘target’ parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-8720 Plugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter

The Plugin README Parser plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘target’ parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-8720

CVE-2025-8720 (Plugin README Parser) affects WordPress Plugin README Parser versions up to and including 1.3.15. The root cause is insufficient input sanitization and output escaping for the target parameter, enabling a Stored Cross-Site Scripting (XSS) attack. Exploitation requires authenticated...

PT-2025-33466 · WordPress · Plugin Readme Parser

Name of the Vulnerable Software and Affected Versions: Plugin README Parser versions up to and including 1.3.15 Description: The Plugin README Parser plugin for WordPress is susceptible to Stored Cross-Site Scripting via the target parameter due to insufficient input sanitization and output...

Malicious code in readme-utils (npm)

The package readme-utils was found to contain malicious code...

MAL-2025-31883 Malicious code in readme-utils (npm)

The package readme-utils was found to contain malicious code...

A-Red-Teamer-diaries

The provided context is a GitHub repository containing a Python script named RunFinger.py and a README.md file. The script is designed to gather information about the domain name and Windows machine running in the network. The README.md file contains information about the purpose of the script an...

CVE-2025-5151

Defog.ai Introspect up to version 0.1.4 contains a code injection vulnerability in introspect/backend/tools/analysis_tools.py: execute_analysis_code_safely, caused by unsafe handling of the code argument. An attacker on the local host could exploit this without user interaction. A patch identifie...

CVE-2023-1767

The Snyk Advisor website https://snyk.io/advisor/ was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README fi...

CVE-2022-4092

An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input...