MAL-2025-6284 Malicious code in events-web (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-7917

WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-7920 Simopro Technology｜WinMatrix3 Web package - Reflected Cross-Site Scripting

WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-7920

CVE-2025-7920 describes a reflected Cross-site Scripting vulnerability in the WinMatrix3 Web package from Simopro Technology. The issue arises from lack of proper filtering/escaping of user-supplied data, enabling unauthenticated attackers to induce a user to execute arbitrary JavaScript in the b...

CVE-2025-7920 Simopro Technology｜WinMatrix3 Web package - Reflected Cross-Site Scripting

WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-7919

CVE-2025-7919 relates to the WinMatrix3 Web package from Simopro Technology, which is affected by an SQL Injection vulnerability. The vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Connected sources provide CVS...

CVE-2025-7919 Simopro Technology｜WinMatrix3 Web package - SQL Injection

WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-7919 Simopro Technology｜WinMatrix3 Web package - SQL Injection

WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-7918 Simopro Technology｜WinMatrix3 Web package - SQL Injection

WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-7917 Simopro Technology｜WinMatrix3 Web package - Arbitrary File Upload

WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2025-30231

Name of the Vulnerable Software and Affected Versions WinMatrix3 Web package versions affected versions not specified Description WinMatrix3 Web package developed by Simopro Technology contains a SQL Injection vulnerability. This allows unauthenticated remote attackers to inject arbitrary SQL...

MAL-2025-5754 Malicious code in @frontend-clients/wallet-web (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a1c436afb2775f8924af545aabce47a320ce8cab9c12dce05ed9e922a67d456 Any computer that has this package installed or running should be considered...

Malicious code in @frontend-clients/wallet-web (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a1c436afb2775f8924af545aabce47a320ce8cab9c12dce05ed9e922a67d456 Any computer that has this package installed or running should be considered...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

MAL-2025-5478 Malicious code in web_for_ntu_flag2 (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-3949 Malicious code in evo-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1963187cd4dc65fd86ae4bdae898bd2fea39e8e6a8464b3b00e2a83f5dcbb95b The OpenSSF Package Analysis project identified 'evo-web' @ 100.0.2 npm as malicious. It is considered malicious because: - The package executes...

Malicious code in healenium-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3021a2416af8ccab79a0fcd8c2e6357b5a7a4b7965ed9edc8c4be0997b7e363 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Missing Authentication for Critical Function

Overview github.com/mattermost/mattermost/server/v8/channels/web is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to servePluginRequest failing to enforce...

Malicious code in cosmos-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6053f00c9e4d23811647b64304eb319d346117494a434dad02865fe92a7e68e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...