CVE-2025-6222: Unrestricted Upload of File with Dangerous Type

The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'cedrnxorderexchangeattachfiles' function in all versions up to, and including, 3.2.6. This...

Malicious code in ethers3-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fb5b9e90e4847906036d20312e485929a131f5272106349e82cb2538bb4b7e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5986 Malicious code in ethers3-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fb5b9e90e4847906036d20312e485929a131f5272106349e82cb2538bb4b7e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-54041

Cross-Site Request Forgery CSRF vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This issue affects Wallet System for WooCommerce: from n/a through = 2.6.7...

CVE-2025-54041

CVE-2025-54041 describes a Cross-Site Request Forgery (CSRF) flaw in the Wallet System for WooCommerce plugin. Affected software: Wallet System for WooCommerce, versions n/a through 2.6.7. Root cause and impact are stated as CSRF allowing an attacker to induce actions on behalf of an authenticate...

CVE-2025-54041 WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This issue affects Wallet System for WooCommerce: from n/a through = 2.6.7...

WordPress plugin Wallet System for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in t...

CVE-2025-54041: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This issue affects Wallet System for WooCommerce: from n/a through = 2.6.7...

MAL-2025-5973 Malicious code in web3js-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96a262a05712b8db4ab5089f2e93098544cbe69efb3e8cd90b4cb67c1c9e04a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3js-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96a262a05712b8db4ab5089f2e93098544cbe69efb3e8cd90b4cb67c1c9e04a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5754 Malicious code in @frontend-clients/wallet-web (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a1c436afb2775f8924af545aabce47a320ce8cab9c12dce05ed9e922a67d456 Any computer that has this package installed or running should be considered...

Malicious code in @frontend-clients/wallet-web (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a1c436afb2775f8924af545aabce47a320ce8cab9c12dce05ed9e922a67d456 Any computer that has this package installed or running should be considered...

MAL-2025-5762 Malicious code in vault-wallet-toolkit (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 038f9aa24c411c91137d75c5519d3628da39a251c2a955d2b651748359a746f0 Any computer that has this package installed or running should be considered...

Malicious code in vault-wallet-toolkit (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 038f9aa24c411c91137d75c5519d3628da39a251c2a955d2b651748359a746f0 Any computer that has this package installed or running should be considered...

Wallets As Universal Access Devices

Wallets are access points for the digital economys value creation. Wallets for blockchains store the end-users cryptographic keys for administrating their digital assets and enable access to blockchain Web3 systems. Web3 delivers new service opportunities. This chapter focuses on the Web3 enabled...

Over 40 Malicious Firefox Extensions Target Cryptocurrency Wallets, Stealing User Assets

Cybersecurity researchers have uncovered over 40 malicious browser extensions for Mozilla Firefox that are designed to steal cryptocurrency wallet secrets, putting users' digital assets at risk. "These extensions impersonate legitimate wallet tools from widely-used platforms such as Coinbase,...

CVE-2025-52294

Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet balance...

CVE-2025-52294

Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet balance...

MAL-2025-6615 Malicious code in wallet-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c83a3acdf0b02acc2a9af7cf885f2f744a154847edc66e1264ee1c38d8d7b984 Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in wallet-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c83a3acdf0b02acc2a9af7cf885f2f744a154847edc66e1264ee1c38d8d7b984 Package silently exfiltrates the provided mnemonic --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...