122917 matches found
MAL-2026-14366 Malicious code in 8-fetchsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0e6a4c6ee9a60609bc1a9e9f1eccfa2166aaf106ba50c35d51aac34ecb3f549 index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, parses the respons...
Malicious code in 8-fetchsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0e6a4c6ee9a60609bc1a9e9f1eccfa2166aaf106ba50c35d51aac34ecb3f549 index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, parses the respons...
Malicious code in stillm4ddpocs-rtest-bravo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e4272ba48bc8a81c8a76e7948aed6974b40956c151f05a613456e92690f5f2 package.json declares scripts.preinstall = 'node index.js', so npm install auto-executes index.js. The script collects hostname, username, home...
MAL-2026-14378 Malicious code in stillm4ddpocs-rtest-bravo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e4272ba48bc8a81c8a76e7948aed6974b40956c151f05a613456e92690f5f2 package.json declares scripts.preinstall = 'node index.js', so npm install auto-executes index.js. The script collects hostname, username, home...
Malicious code in stillm4ddpocs-demo-sprocket (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced86462ad99b91f0f3e3d344e008ca911a1dccdad5c928cee5da5c651756f1d package.json declares scripts.preinstall = 'node index.js'. On install, index.js collects hostname, username, home directory, cwd, local IPv4, public...
MAL-2026-14376 Malicious code in stillm4ddpocs-demo-sprocket (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced86462ad99b91f0f3e3d344e008ca911a1dccdad5c928cee5da5c651756f1d package.json declares scripts.preinstall = 'node index.js'. On install, index.js collects hostname, username, home directory, cwd, local IPv4, public...
PT-2026-79777
Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.12.0 Description A mutation cross-site scripting mXSS issue exists during the serialization of raw-text elements, such as and . When the sanitize dom function processes a DOM tree using a custom policy that retains...
MAL-2026-14355 Malicious code in fuel-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...
Malicious code in fuel-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...
malvinci
malvinci Dieses einfache Skript stellt eine neue Art von Malware vor, die die Firewall deaktiviert, einen HTTP-Server startet, ihren Port über ngrok weiterleitet und die URL des Servers über einen Telegram-Bot sendet. Du musst einen neuen Telegram-BOT erstellen. Folge den Schritten hier, um einen...
CVE-2026-30890
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...
CVE-2026-30890
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...
CVE-2026-54681
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...
CVE-2026-54681 DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...
CVE-2026-54682
DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render i...
python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module
A flaw was found in Python's http.cookies module. The Morsel.jsoutput function, responsible for generating JavaScript output for cookies, does not properly neutralize the HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to...
CVE-2026-75933 Jet Admin Stored XSS
Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...
The Vulners team has released nmap-vulners 2.0
The Vulners team has releasednmap-vulners 2.0. This plugin an NSE script turns the popular Nmap port scanner into a black-box vulnerability scanner. Simply run $ nmap -sV --script vulners to get a prioritized report on vulnerabilities and exploits. And all of this is available for free with no...
Jet Admin Cloud Platform multiple vulnerabilities
RISK EVALUATION Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the...
Malicious code in totp-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...