PT-2025-46289

Name of the Vulnerable Software and Affected Versions Ninja Countdown | Fastest Countdown Builder plugin for WordPress versions through 1.5.0 Description The plugin is susceptible to unauthorized data loss because of a missing capability check on the 'ninja countdown admin ajax' API endpoint...

Malicious code in scattered_slug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d184442b2af5882c7fed54e2cbde6f84ff845f6afd68a5af244d8316be5613 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60940 Malicious code in neutral_parakeet_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1349b47e7c5d582332887496cfb1f754f062fed3d27383b6d8ca5400153ccae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arif-mangga80-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2629bcf2cfe3deb6412e7394f9340828c0d90508b4e0a4cddc158bbaa0884539 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hendra-asinan89-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75aefd28da28cb949d27bce8e7116fcd1ae103134cbde40117bd81da493d7cdf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58861 Malicious code in tania-esdoger35-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89315747bf6378bae0af74f2adaaf50f71b9c693caac346e54f4450fa3402a76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44060

Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...

CVE-2025-63712

Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...

CVE-2025-63711

A Cross-Site Request Forgery CSRF vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint e.g.,...

CVE-2025-63712

Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...

MAL-2025-52287 Malicious code in nina-buburayam46-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4d23910d4a6990e93b9105cc58210f962221716feff2b2ff829fa4beec0c854 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53581 Malicious code in nurul-tongseng69-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2d750d39af50041cb42bf9e3ca3a5861b97069c863ab4b5bed579e6c32ee548 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kresna-kue59-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab5b623fd0bad21d720ff6bf80aba4af9f8f14efc518d7724e6f0c31a9df5a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52047 Malicious code in hanafi-ruwet35-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4db18adb5aa3f98338dc5a4115c4d6638d6a55db659cb28f408898d56ff12330 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52605 Malicious code in vera-kembang5-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bfc7ef27b4eb29368915fe959c79dca195e8ef0d2bec027f64840ce8dd50bd0 The package vera-kembang5-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-49853 Malicious code in bayu-donat16-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 645acdcf997e94ab869ef4ca22cb008781a3408a74fb03a038c3ef8a98aceac8 The package bayu-donat16-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in wawan-tahutek56-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a599e73377566f6dd1746d222582c01a2d53c8a21c5f75f80a1f17c35992d13c The package wawan-tahutek56-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

CVE-2025-12865

U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-12865

U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-12865 e-Excellence｜U-Office Force - SQL Injection

U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents...