Malicious code in basic-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...

MAL-2026-11137 Malicious code in jobber-app-template-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844a2ac73b588b6c0c7c370dd647685768992ff3e6b5ef492e6fc6dc6be240ce The package's preinstall hook runs index.js which fires automatically on npm install. The script collects host reconnaissance os.hostname,...

MAL-2026-11141 Malicious code in lib-streak-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...

Malicious code in app-svm-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1e4595c58a335fee4df04e6d25f61c8a88e8c0e6192bce21f13f8e16ff87a1 package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, test.js fetches an attacker S...

CVE-2026-13946

An inappropriate implementation flaw was found in the ScriptInjections component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513274039...

installer v13.31.0

Overview Installation mql cnspec Scan your target platform Package Information Kubernetes Status Docker Containers: Homebrew: Install.sh: Install.ps1: macOS Pkg: Arch Linux: Installation The easiest way to install mql & cnspec is to use the install scripts. via Shell Script Linux and macOS...

Open Akamai ARL - Cross-Site Scripting Detection

Open Akamai ARL contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Open Akamai ARL contains a cross-site scripting vulnerability.""" from...

WordPress Car Seller - Auto Classifieds Script - SQL Injection Detection

The requestlistrequest AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitize, validate or escape the orderid POST parameter before using it in a SQL statement, leading to a SQL injection...

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

NocoDB < 0.258.0 - Reflected XSS in Password Reset Detection

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId. !/usr/bin/env...

SiYuan Note - Cross-Site Scripting Detection

SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting XSS in the /api/icon/getDynamicIcon endpoint due to improper filtering of SVG elements with a namespace prefix such as . By using a namespaced script element, attackers can bypass the SanitizeSVG...

DedeCMS 5.7 - Cross-Site Scripting Detection

DeDeCMS 5.7 contains a cross-site scripting vulnerability in the '/include/dialog/config.php' file. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """DeDeCMS 5.""" from kittysploit impo...

Odoo <= 15.0 - Cross-Site Scripting Detection

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

MaxSite CMS > V106 - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/...

Trilium <0.52.4 - Cross-Site Scripting Detection

Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Trilium prior to 0.""" from...

SolarView Compact 6.00 - Cross-Site Scripting Detection

SolarView Compact 6.00 contains a cross-site scripting vulnerability via SolarAiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

WordPress Events Calendar <1.4.5 - Cross-Site Scripting Detection

WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

JavaMelody - Cross-Site Scripting Detection

JavaMelody contains a cross-site scripting vulnerability via the monitoring parameter. An attacker can execute arbitrary script in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 --...

Jenkins - Remote Code Execution Detection

Jenkins is susceptible to a remote code execution vulnerability due to accessible script functionality. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins is susceptible to a remote code execution vulnerability due to accessible script functionality.""" from kittysploit import from...

GZ Forum Script 1.8 - Cross-Site Scripting Detection

Cross-site scripting XSS is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. Attackers often initiate an XSS attack by sending a malicious link to a user and enticing the user to click it. !/usr/bin/env python3 -- coding: utf-8...