141 matches found
MAL-2025-113390 Malicious code in dian-lapis2-miaww (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2faa610996169695c1d695972a75b8d4197e1a8aa49644b6dd809ff00442a7d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-64112
Statmatic is a Laravel and Git powered content management system CMS. Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fix...
CVE-2025-64112
CVE-2025-64112 refers to a stored XSS vulnerability in Statamic CMS (Laravel + Git) involving Collections and Taxonomies. The issue allows an authenticated user with content-creation permissions to inject malicious JavaScript that executes for higher-privileged users, potentially enabling credent...
CVE-2025-64112 Statmatic vulnerable to Stored Cross-Site Scripting
Statmatic is a Laravel and Git powered content management system CMS. Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fix...
EUVD-2025-37033
Statmatic is a Laravel and Git powered content management system CMS. Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fix...
Malicious code in epic-creators-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b5d0849fa7db9bbe804078ac1aee6c322be13a55a69e2221bd6499e05248d31 The package epic-creators-analytics was found to contain malicious code...
EUVD-2025-37164
Malicious code in epic-creators-analytics npm...
MAL-2025-49129 Malicious code in epic-creators-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b5d0849fa7db9bbe804078ac1aee6c322be13a55a69e2221bd6499e05248d31 The package epic-creators-analytics was found to contain malicious code...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Collections or Taxonomies components. An attacker can execute arbitrary JavaScript in the context of a higher-privileged user's session by injecting malicious scripts into content fields, leading to...
GHSA-422V-W6C5-VQ42 Moodle exposed the names of hidden groups to users
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information...
EUVD-2025-35667
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information...
EUVD-2018-8031
Malware in sbrugna...
EUVD-2024-34779
Malicious code in bioql PyPI...
EUVD-2025-25835
Malicious code in bioql PyPI...
EUVD-2022-4387
Malicious code in bioql PyPI...
EUVD-2024-45852
Malicious code in bioql PyPI...
CVE-2025-55104
A stored cross-site scripting XSS vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user attacker supplied JavaScript may execute ...
CVE-2025-55104
Summary (CVE-2025-55104): A stored XSS vulnerability affects ArcGIS HUB and ArcGIS Enterprise Sites. An authenticated user who can create or edit a site can store an XSS payload; when triggered, attacker-supplied JavaScript can execute in a victim’s browser. Public exploit details are not provide...
Linux Distros Unpatched Vulnerability : CVE-2023-3893
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin...