CVE-2025-42894

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

Malicious code in crowded-maroon-lungfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 881641d2a92e89f0192a04cffa0b0f2ff1a657f9aeb6bc36ba149f861ee25728 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-71008 Malicious code in suspicious-scarlet-bonobo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cccb4330431bea4e3578b88fa9f0742de52aef811a6150e8fd2ddd6362ab27d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-42894 Path Traversal vulnerability in SAP Business Connector

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

Malicious code in patria-ragi69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c79f4a7392c0da7f16ddd97e5fc30007cb7789ca2d482493c640df908389a9c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64660 Malicious code in okta-gudeg7-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 124091c746d3264e24f8086954bfa2bda32102ef010a70cf0dc9557946f6826e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putra-dodol50-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62d09fd8df9ef048e27d073b38700e223fc1ff5f5a4172be118e3760e76a8366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64030 Malicious code in lina-lumpur30-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6101bd052396494e23a7df418fbf64163c5a7bf7f76a96b20f78dcff3644af13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65583 Malicious code in tiara-kupang97-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector effa81ae72b379eecc8fc576e65cc97dfc70ab7af9239db50f23d05bf71ed9ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-63711

A Cross-Site Request Forgery CSRF vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint e.g.,...

CVE-2025-63712

Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...

PT-2025-46234

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description A Path Traversal issue exists in SAP Business Connector. An attacker with administrator privileges and adjacent access can read, write, overwrite, and delete arbitrary files on...

PT-2025-46289

Name of the Vulnerable Software and Affected Versions Ninja Countdown | Fastest Countdown Builder plugin for WordPress versions through 1.5.0 Description The plugin is susceptible to unauthorized data loss because of a missing capability check on the 'ninja countdown admin ajax' API endpoint...

PT-2025-46340

Name of the Vulnerable Software and Affected Versions Verve Asset Manager affected versions not specified Description A security issue exists in Verve Asset Manager that allows unauthorized read-only users to perform actions beyond their intended permissions. Specifically, these users can read,...

Malicious code in scattered_slug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d184442b2af5882c7fed54e2cbde6f84ff845f6afd68a5af244d8316be5613 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60940 Malicious code in neutral_parakeet_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1349b47e7c5d582332887496cfb1f754f062fed3d27383b6d8ca5400153ccae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arif-mangga80-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2629bcf2cfe3deb6412e7394f9340828c0d90508b4e0a4cddc158bbaa0884539 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hendra-asinan89-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75aefd28da28cb949d27bce8e7116fcd1ae103134cbde40117bd81da493d7cdf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58861 Malicious code in tania-esdoger35-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89315747bf6378bae0af74f2adaaf50f71b9c693caac346e54f4450fa3402a76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44060

Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...