EUVD-2025-198128

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This makes it possible for unauthenticated attackers to...

CVE-2025-12427 YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This makes it possible for unauthenticated attackers to...

CVE-2025-12427 YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This makes it possible for unauthenticated attackers to...

PT-2025-47509

Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4 Description Rallly is a scheduling and collaboration tool. A security issue exists where an authenticated user can modify the display names of other participants in polls without authorization. This is possible b...

WordPress YITH WooCommerce Wishlist plugin <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename vulnerability

Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin YITH WooCommerce Wishlist versions = 4.10.0...

MAL-2025-189251 Malicious code in robotics-auriga-eclipse-parcel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c8603622ee8e5a543e52a8e1616d015299b855bbd4ffd91c72063efc39f558 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in csv-dysonswarm-aether-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36bf85dcddcc722b3f545730fed6924d3f05fa5adac9e83f9ea4111f99186498 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astrophysics-mesosphere-neptunology-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 684bd004536091223ef4c99151f120e9e68cf9d9e4b2583634be658dd965d50d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in load-fire-balance-try-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ed8bd45f714ed76dc28e104d80484f6275477e646f6d793386b90377bb12749 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186637 Malicious code in draco-convict-carina-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ac39405d373fe12213e8d3838763c38a7674b0f4ecae50d5bc7ddfdd67f77e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190040 Malicious code in umbra-mensa-bunyan-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7cd34942a4dfac6c4497a53e8b881b509a19d9a829afbb5b395e04cb5424ac8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Siemens SIMATIC S7-1500 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2023-52444)

"In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link1: f2fsrename ... if olddir != newdir && !whiteout f2fssetlinkoldinode, olddirentry, olddirpage, newdir %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

Siemens SIMATIC S7-1500 NULL Pointer Dereference (CVE-2020-25692)

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service. This plugin only works with...

Malicious code in manu-oy-giososloi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a97933721904ec7c747f794907b73b43493dfb6d0a983356693b1c7b650619b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aiboloa-miope-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07dd54124cc0aac5b58436b922b6af42c71e186058b8338e8cf90928153f831f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179660 Malicious code in kisut-afunig-amfaaicia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bee1488dfcd416196eca574a5d282417a054861704f1fdcbdad9ab8485ced175 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bafai-sunai-cuma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d04fca612a121a1853c51c82e0d3a9163b5c63a5dd2cd850cc9feb2aa5c3de39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-173312 Malicious code in buta-faag-saiafa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2679098d5eaf7411734c5d9de81ab57eafd86cb76a450c98ff1baa1e48b73e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176246 Malicious code in namacda-kangtasa0-nuvayat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c077bbebfee53a70bb19d9c3c518d3346af6bad02c749df302824f477e784f67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176331 Malicious code in nokire-kushina11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f255e19514cfd1c19e12a16ead5d71d1dc18e8dd31081ca1ebc728a941572fbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...