663 matches found
Malicious code in vera-tahu77-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4872c7a3ad39dbe5972a54a4f34b18494f5f7220b844fd9dca75021e4798a0a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-66240 Malicious code in xeric_earwig_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b810b86529c534377a5d8c80447141c9391d24d7a6057de517cdf5bd9dbc5947 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-65635 Malicious code in tomi-lutis19-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d73e52cd9a8f07d37e450b1fcfa637fb0e80c6fcd83dae47a0a0e0db8b2cd8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-63441 Malicious code in ida-sroto43-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5179768d0a41bf74ec4f9a5ca7f199bd52df20354bcbe3e34b230d7947c6e2a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-55467 Malicious code in budi-sate92-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f438d8aaf06d4d0c9b1ecc299623382b7b057346e7c682da6c2b13d490663b95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-54679 Malicious code in rina-getuk21-breki (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a5f03b63c9f27b366e65ad5a44374e1f39725954a1b1443bfbc840a93caa808 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-63716: Cross-Site Request Forgery (CSRF)
The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery CSRF attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints...
CVE-2025-62797 CSRF in FluxCP account endpoints allows account takeover / state-changing actions
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery CSRF vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authoriz...
CVE-2025-62797 CSRF in FluxCP account endpoints allows account takeover / state-changing actions
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery CSRF vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authoriz...
PT-2025-44329
Name of the Vulnerable Software and Affected Versions FluxCP affected versions not specified Description FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery CSRF issue exists in the website template used by multiple rAthena/Ragnarok server...
When the Call Comes from Inside: The Rising Threat of Insider Recruitment in Ransomware Campaigns
In cybersecurity, we often say that attackers only need to be right once – and defenders need to be right every time. Traditionally, we’ve focused on perimeter breaches, phishing campaigns, and zero-day exploits. But increasingly, attackers are bypassing these hardened defenses and taking a...
CVE-2025-9265: Origin Validation Error
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version late...
WordPress plugin WP Go Maps has a cross-site request forgeing vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress...
EUVD-2012-2764
Malware in sbrugna...
EUVD-2007-5888
Malware in sbrugna...
EUVD-2020-4024
Malware in sbrugna...
EUVD-2024-31689
Malicious code in bioql PyPI...
EUVD-2023-29536
Malicious code in bioql PyPI...