MAL-2025-154933 Malicious code in fadila-poke57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 420af1b41ab32d6e711bd692260570b52fae6d54b71c53c0d152045db69d133f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156541 Malicious code in intan-32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aedc6b1fd1a03abe907b3c61d2c46a3ca5291aa2b25440f3e622a461154a458 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149947 Malicious code in @mipta1/asedr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fba7793bb61fb0af8ff8b90c10ca2fa2eb88b05c62dde34affe2780da128d1bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169357 Malicious code in turisna-spsa-reaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef4b6739d78436dd5507a3aa04313f31ae58ca2ce3ac9e38066525f065359c44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154857 Malicious code in fadila-poke123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e1bf9e5f94b0a106b8689b61e016d1941dc6f843e09fda8ef753f4cf4a32b86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-119989

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges...

EUVD-2025-119990

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges...

CVE-2025-12903 Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud

The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/vaultednonce REST API endpoint in all versions up to, and including, 3.2.78. This is due to the endpoint being registered with...

CVE-2025-12903

The CVE-2025-12903 concerns the WordPress plugin Payment Plugins Braintree For WooCommerce. It affects all versions up to 3.2.78 and arises from a missing capability check on the REST endpoint wc-braintree/v1/3ds/vaulted_nonce, registered with permission_callback set to __return_true. This allows...

CVE-2025-12871

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges...

CVE-2025-12870

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges...

CVE-2025-12870

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges...

CVE-2025-12871 aEnrich｜a+HRD - Authentication Abuse

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges...

CVE-2025-12871

CVE-2025-12871 concerns the aEnrich a+HRD product. The connected sources confirm an Authentication Abuse vulnerability where unauthenticated remote attackers can forge administrator access tokens and use them to gain elevated privileges on the system. The issue is attributed to the authentication...

CVE-2025-12871 aEnrich｜a+HRD - Authentication Abuse

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges...

CVE-2025-12870 aEnrich｜eHRD - Authentication Abuse

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges...

CVE-2025-12870

The CVE-2025-12870 entry concerns the a+HRD product from aEnrich. The vulnerability is described as an Authentication Abuse issue whereby unauthenticated remote attackers can craft packets to obtain administrator access tokens and then operate with elevated privileges on the system. The reported ...

CVE-2025-12870 aEnrich｜eHRD - Authentication Abuse

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges...

Malicious code in hercules-meteor-sync-semantic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f1c40a1e572a21b09edc363496e9529bef3811850b83d40f0e9b07ca9d5be10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gulp-nightmare-postcss-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 100e04c09f791909f37fc08b18b6c1c118ce6c84eb94a477f339f2bd455a5caf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...