Malicious code in a0e50092.fcs.pw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cca83b2f419d787c23ce67706427f5f1c42898453520879b5ebf75c8a71340d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3844 Malicious code in nayan-videos-downloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d1573283fc5f3c3cc201c1ab6beeac91054b77dcbcf01aa700ff72240c02260 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3834 Malicious code in imran-photo360-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50eee3813bcaa9eb9f2b3a96b47f8822b60b91073e385c5d3161fce029d42287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3827 Malicious code in ethers-xdc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1291aba3d0c0f6309af00246cdf38a846604fabf82d9cc352bf51f42517b0e20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13823: Improper Neutralization of Input During Web Page Generation

The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...

PT-2025-21465 · WordPress · 360 Product Rotation

Name of the Vulnerable Software and Affected Versions: 360 Product Rotation WordPress plugin versions 1.5.8 and earlier Description: The issue is related to a Reflected Cross-Site Scripting error. This occurs because a parameter is not properly sanitized and escaped before being outputted back in...

WordPress plugin 360 Product Rotation has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

MAL-2025-3794 Malicious code in next-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0038c51339b63eb3fe77a5d623ae004832f05cc831ff582362d202f30a49072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3798 Malicious code in node-method-indicator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60414121dfe5a164bd132ab93d581199d55ba6bff4e937c7b52ecf6ca5fa1e0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mongoose-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3cfffa7f52f4e6d69ba4fc23ded09e40b630a939dac0ba79a7a72feb76aba11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3789 Malicious code in aiide-cur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f87105b04445846be4b509793882c19f03cc302b5a62c868a7f5bc603d6ca1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Alibaba Cloud Linux 3 : 0043: tang (ALINUX3-SA-2024:0043)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0043 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-1672: A race condition exists in the Tang...

GHSA-4GRG-W6V8-C28G Flask uses fallback key instead of current signing key

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last top key in the list to be the most...

Flask uses fallback key instead of current signing key

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last top key in the list to be the most...

Function Call With Incorrect Order of Arguments

Overview Affected versions of this package are vulnerable to Function Call With Incorrect Order of Arguments due to the incorrect handling of the SECRETKEYFALLBACKS configuration. An attacker can exploit this to sign sessions with stale keys, potentially impeding the transition to fresher keys...

DEBIAN-CVE-2025-47278

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

AZL-77828 CVE-2025-47278 affecting package python-flask 1.1.1-4

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

AZL-77831 CVE-2025-47278 affecting package python-flask 1.1.1-4

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

UBUNTU-CVE-2025-47278

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

CVE-2025-47278 Flask uses fallback key instead of current signing key

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...