Malicious code in loliloli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49613dc24146ca83bc9bd4c3192468ff9b16fc61797e4b79a957d79f98d3552b The package loliloli was found to contain malicious code. Source: ghsa-malware 6188273fee11225ff9b29efe7923768ac1792c131fd40768f5127839c6be6ceb Any...

Malicious code in com.unity.polyspatial.xr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f47a6bc79a20cf499736b6544281ecd6035fd1135b3d465ea2b7579061bfc2b The package com.unity.polyspatial.xr was found to contain malicious code. Source: ghsa-malware...

CVE-2025-63223

The Axel Technology StreamerMAX MK II devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and...

CVE-2025-63221

The Axel Technology puma devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system...

CVE-2025-63225

The Eurolab ELTS100UBX device firmware version ELTS100v1.UBX is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized...

Axel WOLF1MS和Axel WOLF2MS 安全漏洞

Axel WOLF1MS and Axel WOLF2MS are both FM network monitoring devices from Axel Italy. A security vulnerability exists in Axel WOLF1MS and Axel WOLF2MS versions 0.8.5 through 1.0.3, which stems from a lack of authentication in the /cgi-bin/gstFcgi.fcgi endpoint, and could lead to a complete crack ...

CVE-2025-63223

The CVE-2025-63223 entry affects Axel Technology StreamerMAX MK II firmware versions 0.8.5–1.0.3. The root cause is Broken Access Control caused by missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint, allowing unauthenticated remote attackers to list user accounts, create new administrat...

CVE-2025-63223

The Axel Technology StreamerMAX MK II devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and...

CVE-2025-63218

The Axel Technology WOLF1MS and WOLF2MS devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and...

CVE-2025-63224

The Itel DAB Encoder IDEnc build 25aec8d is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the...

CVE-2025-63218

The Axel Technology WOLF1MS and WOLF2MS devices firmware versions 0.8.5 to 1.0.3 are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and...

Axel StreamerMAX MK II 安全漏洞

Axel StreamerMAX MK II is an audio codec device from Axel Italy. A security vulnerability exists in the Axel StreamerMAX MK II versions 0.8.5 through 1.0.3, which stems from a lack of authentication in the /cgi-bin/gstFcgi.fcgi endpoint, and could lead to a full crack of the device...

PT-2025-47459

Name of the Vulnerable Software and Affected Versions Axel Technology WOLF1MS and WOLF2MS versions 0.8.5 through 1.0.3 Description The devices are subject to Broken Access Control because of a lack of authentication on the /cgi-bin/gstFcgi.fcgi API endpoint. This allows unauthenticated remote...

CVE-2025-63224

The CVE-2025-63224 entry concerns the Itel DAB Encoder (IDEnc build 25aec8d). The root cause is improper JWT validation across devices, enabling authentication bypass: an attacker with a valid JWT from one device can authenticate as an admin on any other device running the same firmware. This lea...

Malicious code in mongoose-odm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96769a7d9b829c0679f6d50c1f0c7cf119eb49605c5dc6d9b7b1a05c2b655c9 The package mongoose-odm was found to contain malicious code. Source: ghsa-malware f652b1e2a0f5c99554f46ab757d97e6038f7e5cac1d2c51a2a01851b744884f2 A...

MAL-2025-190565 Malicious code in tailwindcss-setfavicon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91fc0eceb962b96f45fa2c5b85fe82bd7dd8a56b13ee4fe7e460091b7650af6f The package tailwindcss-setfavicon was found to contain malicious code. Source: ghsa-malware...

CVE-2025-63217

The CVE describes an Authentication Bypass in the Itel DAB MUX (IDMUX build c041640a) caused by improper JWT validation across devices. Exploitation would allow an attacker who has a valid JWT from one device to authenticate as an administrator on any other device running the same firmware, enabl...

PT-2025-47410

Name of the Vulnerable Software and Affected Versions Itel DAB MUX versions affected versions not specified Description The Itel DAB MUX IDMUX build c041640a has a flaw in how it verifies JWT JSON Web Token authentication. This allows an attacker who has a valid JWT token from one device to use i...

CVE-2025-63225

The Eurolab ELTS100UBX device firmware version ELTS100v1.UBX is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized...

CVE-2025-63217

The Itel DAB MUX IDMUX build c041640a is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the...