MAL-2026-11141 Malicious code in lib-streak-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...

Malicious code in app-svm-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1e4595c58a335fee4df04e6d25f61c8a88e8c0e6192bce21f13f8e16ff87a1 package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, test.js fetches an attacker S...

CVE-2026-13946

An inappropriate implementation flaw was found in the ScriptInjections component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513274039...

Malicious code in @wagni_bot/polygon (npm)

The npm package @wagnibot/polygon is a supply-chain credential stealer disguised as a Polygon SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/bsc (npm)

The npm package @wagnibot/bsc is a supply-chain credential stealer disguised as a BNB Smart Chain BSC SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...

installer v13.31.0

Overview Installation mql cnspec Scan your target platform Package Information Kubernetes Status Docker Containers: Homebrew: Install.sh: Install.ps1: macOS Pkg: Arch Linux: Installation The easiest way to install mql & cnspec is to use the install scripts. via Shell Script Linux and macOS...

Ricoh Web Image Monitor - Reflected XSS Detection

A reflected cross-site scripting vulnerability exists in the laser printers and MFPs multifunction printers which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. !/usr/bin/env python3 -- coding:...

phpMyAdmin < 5.1.2 - Cross-Site Scripting Detection

An issue was discovered in phpMyAdmin 5.1 before 5.1.2 that could allow an attacker to inject malicious code into aspects of the setup script, which can allow cross-site or HTML injection. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered in phpMyAdmin 5.""" from kittysploit...

WordPress JSmol2WP <=1.07 - Cross-Site Scripting Detection

WordPress JSmol2WP version 1.07 and earlier is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress JSmol2WP version 1.""" from kittysploit import from...

PHPJabbers Food Delivery Script v3.0 - SQL Injection Detection

PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Food Delivery Script v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHPJabbers Food Delivery Script - SQL Injection Detection

PHPJabbers Food Delivery Script 3.0 has a SQL injection SQLi vulnerability in the "q" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Food Delivery Script 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Moodle LTI module Reflected - Cross-Site Scripting Detection

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Royal Event Management System - Stored Cross-Site Scripting Detection

Royal Event Management System contains a stored cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS Detection

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. !/usr/bin/env python3 -- coding: utf-8 -- """LinuxServer.""" from kittysploit import from...

Monstra CMS <=3.0.4 - Cross-Site Scripting Detection

Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

Schools Alert Management Script - Arbitrary File Read Detection

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f paramet...

GeoServer <1.2.2 - Remote Code Execution Detection

Programs run on GeoServer before 1.2.2 which use jt-jiffle and allow Jiffle script to be provided via network request are susceptible to remote code execution. The Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects downstream GeoServer 1.1.22...

WordPress FlagEm - Cross-Site Scripting Detection

WordPress FlagEm plugin contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks...

WordPress Knews Multilingual Newsletters 1.1.0 - Cross-Site Scripting Detection

WordPress Knews Multilingual Newsletters 1.1.0 plugin contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials an...

WordPress Slideshow - Cross-Site Scripting Detection

WordPress Slideshow plugin contains multiple cross-site scripting vulnerabilities. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...