MAL-2025-7996 Malicious code in @hey-amplify/scripts (npm)

The package @hey-amplify/scripts was found to contain malicious code...

Malicious code in @hey-amplify/scripts (npm)

The package @hey-amplify/scripts was found to contain malicious code...

CVE-2024-28056

Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently...

CVE-2025-4318

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

CVE-2025-4318

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

CVE-2025-4318 Input validation issue in AWS Amplify Studio UI component properties

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

CVE-2025-4318 Input validation issue in AWS Amplify Studio UI component properties

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

CVE-2025-4318 Input validation issue in AWS Amplify Studio UI component properties

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

CVE-2025-4318

CVE-2025-4318 affects the package aws-amplify/amplify-codegen-ui used with AWS Amplify Studio. The vulnerability is described as a lack of input validation in UI component property expressions, which could allow an authenticated user with access to create or modify components to execute arbitrary...

PT-2025-19763

Name of the Vulnerable Software and Affected Versions aws-amplify/amplify-codegen-ui affected versions not specified Description The issue is related to a lack of input validation in the AWS Amplify Studio UI component property expressions. This could potentially allow an authenticated user who h...

Amplify Codegen UI 安全漏洞

Amplify Codegen UI is an AWS Amplify open source React component generated for use in the AWS Amplify project. A security vulnerability exists in Amplify Codegen UI that stems from a lack of input validation for AWS Amplify Studio UI component property expressions, which could lead to the executi...

@aws-amplify/amplify-app (>=5.0.39-beta-latest.0, <=5.0.42), @aws-amplify/amplify-appsync-simulator (>=2.16.10-beta-latest.0, <=2.16.12) +67 more potentially affected by unknown CVE via aws-cdk-lib (>=2.172.0, <=2.189.0)

aws-cdk-lib NPM version =2.172.0, =5.0.39-beta-latest.0, =2.16.10-beta-latest.0, =5.0.38-beta-latest.0, =3.7.18-beta-latest.0, =3.1.26-beta-latest.0, =5.7.12-beta-latest.0, =3.5.18-beta-latest.0, =3.5.39-beta-latest.0, =5.1.31-beta-latest.0, =2.26.28-beta-latest.0, =5.5.18-beta-latest.0,...

CVE-2024-51691

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aryanduntley Admin Amplify wpr-admin-amplify allows Reflected XSS.This issue affects Admin Amplify: from n/a through = 1.3.0...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +407 more potentially affected by CVE-2025-23206 via aws-cdk-lib (>=2.0.0, <=2.176.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.0.0-ampgenconfig.0, =3.1.25 and more Source cves: CVE-2025-23206 Source advisory:...

CVE-2024-51691

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aryanduntley Admin Amplify wpr-admin-amplify allows Reflected XSS.This issue affects Admin Amplify: from n/a through = 1.3.0...

CVE-2024-51691 WordPress Admin Amplify plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aryanduntley Admin Amplify wpr-admin-amplify allows Reflected XSS.This issue affects Admin Amplify: from n/a through = 1.3.0...

CVE-2024-51691 WordPress Admin Amplify plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aryanduntley Admin Amplify wpr-admin-amplify allows Reflected XSS.This issue affects Admin Amplify: from n/a through = 1.3.0...

CVE-2024-51691

CVE-2024-51691: Reflected Cross-Site Scripting in Admin Amplify (WordPress plugin) allows input in Admin Amplify to be reflected in web pages. Affected versions: Admin Amplify up to 1.3.0. Patch status: Unpatched (as per Red Hat/Wordfence entries).

WordPress plugin Admin Amplify 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-34838 · Aryan Duntley · Admin Amplify

Name of the Vulnerable Software and Affected Versions: Aryan Duntley Admin Amplify versions 1.3.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: F...