120 matches found
CVE-2026-111626
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...
EUVD-2026-103048
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...
CVE-2026-111626
The Webreaper Damselfly software (through version 4.5.3 ) is vulnerable to an authentication bypass because controller authorization attributes are commented out. This flaw allows unauthenticated attackers to access all */api/ routes. By sending a PUT /api/users request with Admin roles, an attac...
CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...
CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...
PT-2026-116025
Name of the Vulnerable Software and Affected Versions Webreaper Damselfly versions prior to 4.5.4 Description An authentication bypass exists because controller authorization attributes are commented out, allowing unauthenticated attackers to access all /api/ endpoints. This can be exploited by...
Malicious Package
Overview allied-red-damselfly is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2025-117355
Malicious code in gay-gold-damselfly npm...
EUVD-2025-117166
Malicious code in poor-sapphire-damselfly npm...
MAL-2025-138936 Malicious code in poor-sapphire-damselfly (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65ee162fd526da4df56d69f605301ea0857b0794c46bb6f558559941d8ed7541 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-134363 Malicious code in intelligent_damselfly_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75a0cc6c25ed1f0c50627a9e0bb1cba726f826881a03dc7e05e8a592f0c8be74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-102705
Malicious code in reardamselflyz3n npm...
EUVD-2025-101742
Malicious code in tinydamselflyz3n npm...
EUVD-2025-99086
Malicious code in explicitdamselflyz3n npm...
Malicious code in tiny_damselfly_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab0d8575b76df72e0e24bf09af831318a766a2e748ecad4870e42de21581e893 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-105170
Malicious code in formaldamselflyz3n npm...
EUVD-2025-94897
Malicious code in suddendamselflyz3n npm...
EUVD-2025-94170
Malicious code in visibledamselflyz3n npm...