CVE-2025-42894 Path Traversal vulnerability in SAP Business Connector

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

MAL-2025-64660 Malicious code in okta-gudeg7-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 124091c746d3264e24f8086954bfa2bda32102ef010a70cf0dc9557946f6826e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in patria-ragi69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c79f4a7392c0da7f16ddd97e5fc30007cb7789ca2d482493c640df908389a9c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64030 Malicious code in lina-lumpur30-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6101bd052396494e23a7df418fbf64163c5a7bf7f76a96b20f78dcff3644af13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putra-dodol50-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62d09fd8df9ef048e27d073b38700e223fc1ff5f5a4172be118e3760e76a8366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65583 Malicious code in tiara-kupang97-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector effa81ae72b379eecc8fc576e65cc97dfc70ab7af9239db50f23d05bf71ed9ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-63711

A Cross-Site Request Forgery CSRF vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint e.g.,...

CVE-2025-63712

Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...

CVE-2025-12126: Authorization Bypass Through User-Controlled Key

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access a...

PT-2025-46234

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description A Path Traversal issue exists in SAP Business Connector. An attacker with administrator privileges and adjacent access can read, write, overwrite, and delete arbitrary files on...

PT-2025-46340

Name of the Vulnerable Software and Affected Versions Verve Asset Manager affected versions not specified Description A security issue exists in Verve Asset Manager that allows unauthorized read-only users to perform actions beyond their intended permissions. Specifically, these users can read,...

PT-2025-46289

Name of the Vulnerable Software and Affected Versions Ninja Countdown | Fastest Countdown Builder plugin for WordPress versions through 1.5.0 Description The plugin is susceptible to unauthorized data loss because of a missing capability check on the 'ninja countdown admin ajax' API endpoint...

Malicious code in scattered_slug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d184442b2af5882c7fed54e2cbde6f84ff845f6afd68a5af244d8316be5613 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60940 Malicious code in neutral_parakeet_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1349b47e7c5d582332887496cfb1f754f062fed3d27383b6d8ca5400153ccae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arif-mangga80-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2629bcf2cfe3deb6412e7394f9340828c0d90508b4e0a4cddc158bbaa0884539 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hendra-asinan89-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75aefd28da28cb949d27bce8e7116fcd1ae103134cbde40117bd81da493d7cdf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58861 Malicious code in tania-esdoger35-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89315747bf6378bae0af74f2adaaf50f71b9c693caac346e54f4450fa3402a76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44060

Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...

CVE-2025-63712

Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...

CVE-2025-63711

A Cross-Site Request Forgery CSRF vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint e.g.,...