MAL-2025-81141 Malicious code in romantic_sawfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a8db304eaaa73ff562d07d2d56479e72aa5e29bf3cc15dcb19fffc14178c379 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-78219 Malicious code in fitri-buburayam49-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9dd8d05d71e6f0d1d4111e550d57e7276b8b6eaa2d8c4dc30ea02fd83e0235e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wawan-sate44-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4621483e302ccbe26fffb35f7c823991d3a6f110a2511ca6302f17e97873587c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-77890 Malicious code in encouraging_aardvark_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61e5cbb5dad715335e82030f0925088cd16a9f77dddc87a647046a4036ed42ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-78292 Malicious code in frail_caterpillar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f32a58c8b1f1b71fdf7134e80c1894c33d15702cf5efd69f9f939255b771c2f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12864

U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-12665 Ninja Countdown <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion

The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninjacountdownadminajax' AJAX endpoint in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with...

EUVD-2025-60985

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

Malicious code in vida-lepet41-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ec4d88f282a4f41630aa41d7201c08b6ebe01aace4924558e9d30784ef0ce39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74242 Malicious code in lutfi-kue74-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ccb40c1c561f2617e5b7ddf952752f1bc63b1cbf53c5281cc8b26b9429966af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-42894

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

Malicious code in crowded-maroon-lungfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 881641d2a92e89f0192a04cffa0b0f2ff1a657f9aeb6bc36ba149f861ee25728 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-71008 Malicious code in suspicious-scarlet-bonobo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cccb4330431bea4e3578b88fa9f0742de52aef811a6150e8fd2ddd6362ab27d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-42894 Path Traversal vulnerability in SAP Business Connector

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

Malicious code in patria-ragi69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c79f4a7392c0da7f16ddd97e5fc30007cb7789ca2d482493c640df908389a9c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64660 Malicious code in okta-gudeg7-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 124091c746d3264e24f8086954bfa2bda32102ef010a70cf0dc9557946f6826e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putra-dodol50-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62d09fd8df9ef048e27d073b38700e223fc1ff5f5a4172be118e3760e76a8366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64030 Malicious code in lina-lumpur30-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6101bd052396494e23a7df418fbf64163c5a7bf7f76a96b20f78dcff3644af13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65583 Malicious code in tiara-kupang97-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector effa81ae72b379eecc8fc576e65cc97dfc70ab7af9239db50f23d05bf71ed9ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-63711

A Cross-Site Request Forgery CSRF vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint e.g.,...