EUVD-2025-204944

Malicious code in amazon-testpackage npm...

MAL-2025-192709 Malicious code in amazon-testpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24a2f5487cf50f0172b998f136ba4a0b02416b3aebf52528c59eeeaaf6d64bd The package amazon-testpackage was found to contain malicious code...

CVE-2025-67743

CVE-2025-67743 affects Local Deep Research. The vulnerability lies in the download service (download_service.py) where HTTP requests are made with raw requests.get() without SSRF protection, bypassing safeguards in safe_requests.py/ssrf_validator.py. This can allow an attacker to access internal ...

Malicious code in airslate-dep-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91777938469aa47ed3a4eb51c82af2752f2dd57b232978a88bfacdd3b82b1fe1 The package airslate-dep-webpack was found to contain malicious code...

Malicious code in ro-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba9c94a8695242e09289eca1f734da5c96b789f911e1e1cbc6a7279486dfb36d The package ro-mobile was found to contain malicious code. Source: ghsa-malware 9720efd6aba66e7a6a07c30debc177402cf521360448144f8804370656d64b88 Any...

Malicious code in mui-wrapper-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 990f5534f23c3e77faec1b92be83c7827d3136d03abcfefd245b8fa4f987bd52 The package mui-wrapper-core was found to contain malicious code. Source: ghsa-malware ba2ba20b7b8b4a7fae1afa52854fe8be2f326067033269e32445cd20cbad44...

Malicious code in ivx-cloud-client-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1fbfc03c64d280029c66ce70086ae89a6300a262c85cf73a4f3a55357ee56d The package ivx-cloud-client-v1 was found to contain malicious code...

GO-2025-4250 Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go

Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go...

CVE-2025-14734

The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'ADALsettingspage' function. This makes it possible for unauthenticated attackers to update...

EUVD-2025-204630

The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'ADALsettingspage' function. This makes it possible for unauthenticated attackers to update...

EUVD-2025-204632

The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-14734

The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'ADALsettingspage' function. This makes it possible for unauthenticated attackers to update...

CVE-2025-14735

The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-14734

CVE-2025-14734 concerns the Amazon affiliate lite Plugin for WordPress. The vulnerability is a Cross-Site Request Forgery (CSRF) affecting all versions up to 1.0.0, caused by missing or incorrect nonce validation in the ADAL_settings_page function. This enables unauthenticated attackers to update...

CVE-2025-14734 Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update

The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'ADALsettingspage' function. This makes it possible for unauthenticated attackers to update...

CVE-2025-14734 Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update

The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'ADALsettingspage' function. This makes it possible for unauthenticated attackers to update...

CVE-2025-14735 Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-14735 Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-52544

Name of the Vulnerable Software and Affected Versions Amazon affiliate lite Plugin versions prior to 1.0.1 Description The Amazon affiliate lite Plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation within the ADAL settings page function. This allo...

CVE-2025-14735: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...