@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: MEND:CVE-2025-57753...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +157 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...

CVE-2025-57753

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

CVE-2025-57753 vite-plugin-static-copy files not included in `src` are accessible with a crafted request

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

CVE-2025-57753 vite-plugin-static-copy files not included in `src` are accessible with a crafted request

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2...

CVE-2025-57753

The CVE-2025-57753 vulnerability affects vite-plugin-static-copy (a Rollup plugin for Vite). Affected versions allow a crafted HTTP request to access files not included in src when the Vite dev server is exposed to the network. Impact is information disclosure of files outside the intended direct...

vite-plugin-static-copy files not included in `src` are possible to access with a crafted request

Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...

@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: SNYK:JS-VITEPLUGINSTATICCOPY-12179280...

@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: OSV:GHSA-PP7P-Q8FX-2968...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +157 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...

Directory Traversal

Overview vite-plugin-static-copy is a rollup-plugin-copy for vite with dev server support. Affected versions of this package are vulnerable to Directory Traversal via the viaLocal function. An attacker can access arbitrary files on the server by sending crafted HTTP requests that exploit path...

GHSA-PP7P-Q8FX-2968 vite-plugin-static-copy files not included in `src` are possible to access with a crafted request

Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...

@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: GHSA-PP7P-Q8FX-2968...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +157 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +157 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...

GHSA-287X-6R2H-F9MW UnoPim vulnerable to CSRF on Product edit feature and creation of other types

Summary Some of the endpoints of the application is vulnerable to Cross site Request forgery CSRF. | Method | Endpoint | Status | Reason | |:------:|:------:|:------:|:------:| | POST | /admin/catalog/products/create | Not Vulnerable :whitecheckmark: | X-XSRF-TOKEN header used | | GET |...

CVE-2025-8895

The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including, 3.3.5. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server to arbitrary locations...

CVE-2025-8895

CVE-2025-8895 affects the WP Webhooks plugin for WordPress. It allows unauthenticated arbitrary file copy due to missing input validation in all versions up to and including 3.3.5, enabling access to sensitive files (e.g., wp-config.php) and database credentials. The vulnerability is rated critic...

CVE-2025-8895 WP Webhooks <= 3.3.5 - Unauthenticated Arbitrary File Copy

The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including, 3.3.5. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server to arbitrary locations...

CVE-2025-8895 WP Webhooks <= 3.3.5 - Unauthenticated Arbitrary File Copy

The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including, 3.3.5. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server to arbitrary locations...