501 matches found
CVE-2025-26391: Improper Neutralization of Input During Web Page Generation
SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account...
Malicious code in manurung-poke5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed072b1273b548b4b0d2cfe92c0c2af56b44aad1e26e0270116840d173af1b1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in uaragifa-mar-safut (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfd53869e1c64a55a0d8d05af4fe67d5289f21c23d56239ff9d4e7de42780cdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in cosmos-blitz-got-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3cab308e3dfecb0e0f1d7e5a6ac6a093767de259085409cb5e48b1f410f5560 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in tania-kue13-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 239baa4ee5be2314b00c6366075b5d161fc8a0c12288c3839e1382e0c010d0f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-113654 Malicious code in equivalent_octopus_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e68dea4a627d24bdb57077c5b195a9f8139bfd9177195fb7c4f4c1888191a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-58829 Malicious code in surya-oncom19-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ed6f4edca41a620304bcebc5e28da441c610e0b0574f5bda888fe1ef7614beb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-63420
CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions...
CVE-2025-63420
CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions...
CrushFTP 安全漏洞
CrushFTP is a file transfer server from CrushFTP, Inc. A security vulnerability exists in CrushFTP version 11.3.750, which stems from the Reports/Who Created Folder feature in the Admin Panel not handling input correctly, which could lead to a stored cross-site scripting attack...
PT-2025-45509
Name of the Vulnerable Software and Affected Versions CrushFTP version 11.3.7 50 Description A stored cross-site scripting XSS issue exists in the CrushFTP Admin Panel, specifically within the Reports / 'Who Created Folder' section. Authenticated attackers who have folder creation permissions can...
CVE-2025-40643
Stored Cross-Site Scripting XSS vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/createjobsubmit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote...
CVE-2025-40643 Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker
Stored Cross-Site Scripting XSS vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/createjobsubmit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote...
EUVD-2025-35664
Stored Cross-Site Scripting XSS vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/createjobsubmit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote...
CVE-2025-40643 Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker
Stored Cross-Site Scripting XSS vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/createjobsubmit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote...
CVE-2025-40643
Energy CRM v2025 by Status Tracker Ltd contains a Stored XSS in the /crm/create_job_submit.php endpoint via the JobCreatedBy input. The lack of proper validation allows an attacker to craft a request that could be stored and later executed in an authenticated user’s browser, potentially exposing ...
EUVD-2018-19456
Malware in sbrugna...
EUVD-2007-2984
Malware in sbrugna...
Unity Linux 20.1070e Security Update: python3 (UTSA-2025-987414)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987414 advisory. A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing th...