Malicious code in chalk-subscription-mutation-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ef6069b47a6b2862e67c0f0f0744fb681095e2822c4e2f137380f566fd627e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123911

Malicious code in pavo-subscription-hyperion-impulse npm...

EUVD-2025-115502

Malicious code in chai-sedna-configstore-subscription npm...

EUVD-2025-123271

Malicious code in promise-subscription-pipe-bellatrix npm...

EUVD-2025-115943

Malicious code in buffer-materialize-config-subscription npm...

EUVD-2025-114580

Malicious code in delphinus-subscription-mongodb-airbnb npm...

EUVD-2025-121568

Malicious code in subscription-ganymede-update-loglevel npm...

Malicious code in hermes-concurrently-hermes-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e0fc504fe20b5d7a624bf4f16d4f30312aae20867a0ab2bca5a06e6e80bd777 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141180 Malicious code in cosmiconfig-firebase-warp-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eee21f35eb9805d7f31c7f493c82f906f9774634ec1b223e8d3c7fafec2331c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149124 Malicious code in venus-subscription-pino-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b084d77d240ddb72fc2468a96b8d733738ecf2c519fff700a0354752768c0774 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141383 Malicious code in cygnus-subscription-loglevel-castor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a14f5f7acca2db1c52ece29d5ea1c8cc85499a0ac6b337fcb30226a7f4fe4e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148366 Malicious code in subscription-request-koa-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c68b8002383770872ccdad0a33557462f10d80f27bd85d0cf04a9636bc71571 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149560 Malicious code in wolf-pyxis-rollup-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 825b2089e674a1b4f07d988dd4dd46073f675eb1896bfdf21ad1489f1458389c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140034 Malicious code in blaze-uglify-js-schema-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f8d5f1ce6793923e6a5f433e28c137a347dd3e3071b1cfcf658b2ec25fcd7b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

CVE-2025-12901

The CVE-2025-12901 entry concerns the WordPress plugin Asgaros Forum. Reports across multiple sources confirm a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 3.2.1 caused by missing nonce validation in the set_subscription_level() function, enabling unauthenticated attacke...

WordPress plugin Asgaros Forum 跨站请求伪造漏洞

WordPress Asgaros Forum plugin is a lightweight forum plugin designed for WordPress that supports the rapid creation and management of forum pages, providing basic posting, replying, user management and other functions. The WordPress Asgaros Forum plugin suffers from a cross-site request forgery...

WordPress plugin Easy Email Subscription 跨站脚本漏洞

The WordPress Easy Email Subscription plugin is a plugin for adding email subscription functionality to your WordPress website, allowing users to receive new content updates via email. WordPress Easy Email Subscription plugin suffers from a cross-site scripting vulnerability that stems from the...