GHSA-C7VQ-M7F8-RX37

creationtimestamp| type| source ---|---|--- 2025-05-16 14:39:43+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16691 2025-05-16 15:17:25+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114518172966589726...

MAL-2025-3920 Malicious code in statewars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3054b3bc016fb28cbd39ad6ff12e082819c4ded2b17560fa6a0d5e750c80f61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3916 Malicious code in seagroup-assets-management-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44bc2e3fe919ef26fcd2d1f0c35594c222160c51fff19083d9be40017cc2689 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3900 Malicious code in lcs-ui-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b66ec079f142a51c33d484015aab0384b514dca3415e27b84138f92dd2ea818 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3881 Malicious code in date-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c85611f0d2bf7147b9f3fc95fad6c21702ef493fad36161c2e8becab150a2d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3922 Malicious code in twitter-api-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e845c35069d8dc1f87dbd947c508662a7462d951bfd0ccd915be80cb99502a96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1245

creationtimestamp| type| source ---|---|--- 2025-05-16 06:35:18+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16635 2025-05-16 09:03:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpboahws4i2l...

MAL-2025-3872 Malicious code in arcademathjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 655da6e51b197ee6dc274cd7147f0488c545a7d83eb4626f78bacdd3d57d482b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Code Injection in Ivanti Endpoint_Manager_Mobile

CVE-2025-4427 & CVE-2025-4428 Vulnerability Scanner !Python...

Debian: Security Advisory (DLA-4165-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DaaS - Client IP detection for Network Location Service

How is actual Client IP determined for Network location detection, when traffic from both internal and external Clients is routed through a Proxy? This is important when Clients access the Cloud Workspace through a Proxy, irrespective of Client's location - inside or outside corporate network...

SUSE: Security Advisory (SUSE-SU-2025:1551-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-5920-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Server-Side Template Injection Vulnerabilities and Exploitation Techniques

Research article called Server-Side Template Injection SSTI Vulnerabilities and Exploitation Techniques. The paper provides a structured methodology for detecting and exploiting SSTI vulnerabilities across multiple template engines, along with real-world case studies and mitigation strategies...

CVE-2025-47287

creationtimestamp| type| source ---|---|--- 2025-05-15 21:33:28+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16573 2025-05-15 23:02:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpamomwuhf2n 2025-05-24 20:06:27+00:00| seen|...

CVE-2025-4720 SourceCodester Student Result Management System drop_student.php path traversal

A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file academic/core/dropstudent.php. The manipulation of the argument img leads to path traversal. The attack can be initiated remotely...

CVE-2025-1138

creationtimestamp| type| source ---|---|--- 2025-05-15 20:33:33+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16554...

MAL-2025-3828 Malicious code in fastifiyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3da19b8f86e82a5ab61d8134531f7e1f001bf858555808eca76c3f03deeff06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Ivanti Endpoint_Manager_Mobile

CVE-2025-4427 and CVE-2025-4428 Ivanti EPMM Chain Ivanti EPMM...

MAL-2025-3831 Malicious code in helvetia-base-patterns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3682a1cff47d9425b9d7c8d820704387f078a2f5ee4dadc955da09c859c23579 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...