CVE-2025-65923

A Stored Cross-Site Scripting XSS vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. An attacker can embed malicious JavaScript code into a CSV field, which is then stored in the database and executed whenever the...

VulnCheck KEV: CVE-2025-14975

The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account...

EUVD-2020-30995

webTareas 2.0.p8 contains a file deletion vulnerability in the printlayout.php administration component that allows authenticated attackers to delete arbitrary files. Attackers can exploit the vulnerability by manipulating the 'atttmp1' parameter to specify and delete files on the server through ...

FUXA allows Remote Code Execution (RCE) via the project import functionality.

FUXA v1.2.7 allows Remote Code Execution RCE via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise...

CVE-2025-69983

FUXA v1.2.7 allows Remote Code Execution RCE via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise...

CVE-2025-65923

A Stored Cross-Site Scripting XSS vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. An attacker can embed malicious JavaScript code into a CSV field, which is then stored in the database and executed whenever the...

CVE-2020-37116

GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise...

CVE-2025-52626

A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0...

CVE-2025-52627

Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0...

EUVD-2025-206681

Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0...

Malicious code in js-unpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baae4c9e1fb444bb1fc5b81f94160a8301839d4ce71d2cb92b50b06037018c73 The package js-unpack was found to contain malicious code. Source: ghsa-malware 5d6859e5b9008340bf7f7c4d7128416913b37bf079c0b1657f6e9857b6b9f0db Any...

MAL-2026-707 Malicious code in js-unpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baae4c9e1fb444bb1fc5b81f94160a8301839d4ce71d2cb92b50b06037018c73 The package js-unpack was found to contain malicious code. Source: ghsa-malware 5d6859e5b9008340bf7f7c4d7128416913b37bf079c0b1657f6e9857b6b9f0db Any...

MAL-2026-705 Malicious code in @devgandhi/cpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75ac0fee4da2336960b7a3551c697d57364d11a28a1b4b0991d2e67d29e77299 The package @devgandhi/cpp was found to contain malicious code. Source: ghsa-malware ec9e2c8acf6e1bbf43856590ba2b792340a399ac92f20fee69d7f47843e3a58e...

Malicious code in @devgandhi/cpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75ac0fee4da2336960b7a3551c697d57364d11a28a1b4b0991d2e67d29e77299 The package @devgandhi/cpp was found to contain malicious code. Source: ghsa-malware ec9e2c8acf6e1bbf43856590ba2b792340a399ac92f20fee69d7f47843e3a58e...

Malicious code in @devgandhi/healthpulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59a052fcc97593bfdb07bb6a57d80e8a3eac89d20d8ac264748408de1724cdf0 The package @devgandhi/healthpulse was found to contain malicious code. Source: ghsa-malware...

MAL-2026-706 Malicious code in @devgandhi/healthpulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59a052fcc97593bfdb07bb6a57d80e8a3eac89d20d8ac264748408de1724cdf0 The package @devgandhi/healthpulse was found to contain malicious code. Source: ghsa-malware...

CVE-2020-37116 GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access

GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise...

CVE-2025-67850

A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting XSS, occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions...

CVE-2025-67851

A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to...

UBUNTU-CVE-2025-67850

A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting XSS, occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions...