Malicious code in parallely (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...

MAL-2026-11143 Malicious code in parallely (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...

MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

AVTECH Video Surveillance Product - Unauthenticated File Download Detection

AVTECH video surveillance products unauthenticated file download from web root through /cgi-bin/cgibox, Since the .cab string is verified by the strstr method, the file download can be realized by adding ?.cab at the end of the file name. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH video...

Tinymce Thumbnail Gallery <=1.0.7 - Local File Inclusion Detection

Tinymce Thumbnail Gallery 1.0.7 and before are vulnerable to local file inclusion via download-image.php. !/usr/bin/env python3 -- coding: utf-8 -- """Tinymce Thumbnail Gallery 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval Detection

WordPress Email Subscribers & Newsletters plugin before 4.2.3 is susceptible to arbitrary file retrieval via a flaw that allows unauthenticated file download and user information disclosure. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative...

BIQS IT Biqs-drive v1.83 Local File Inclusion Detection

A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user. !/usr/bin/env...

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download Detection

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...

Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download Detection

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data. !/usr/bin/env python3 -- coding: utf-8 -- """The File Download API in Wipro Holmes...

BackupBuddy - Local File Inclusion Detection

BackupBuddy versions 8.5.8.0 - 8.7.4.1 are vulnerable to a local file inclusion vulnerability via the 'download' and 'local-destination-id' parameters. !/usr/bin/env python3 -- coding: utf-8 -- """BackupBuddy versions 8.""" import re from kittysploit import from lib.protocols.http.httpclient impo...

WordPress Download Manager <= 3.2.59 - Reflected XSS Detection

W3 Eden, Inc. Download Manager plugin = 3.2.59 contains a reflected cross-site scripting caused by insufficient input sanitization, letting attackers execute scripts in the context of the victim's browser, exploit requires attacker to craft a malicious link. !/usr/bin/env python3 -- coding: utf-8...

WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure Detection

The WordPress Download Manager plugin before version 3.3.07 does not prevent directory listing on web servers that don't use htaccess, allowing unauthorized access to files stored in the download-manager-files directory. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Download Manager...

DVDFab 12 Player/PlayerFab - Local File Inclusion Detection

DVDFab 12 Player/PlayerFab is susceptible to local file inclusion which allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player recently renamed PlayerFab has read-access. !/usr/bin/env python3 -- coding: utf-8 -- """DVDFab 12...

Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal Detection

Directory traversal vulnerability in the Tom M8te tom-m8te plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php. !/usr/bin/env python3 -- coding: utf-8 -- """Directory traversal vulnerability in the Tom M8te tom-m8te plugin 1."...

instaloader v4.15.3

.. image:: https://raw.githubusercontent.com/instaloader/instaloader/master/docs/logoheading.png .. badges-start |pypi| |pyversion| |license| |aur| |contributors| |downloads| .. |pypi| image:: https://img.shields.io/pypi/v/instaloader.svg :alt: Instaloader PyPI Project Page :target:...

PT-2026-65577

Name of the Vulnerable Software and Affected Versions IBM Aspera Desktop App versions 1.0.5 through 1.0.19 Description IBM Aspera for desktop contains a path traversal flaw that allows files to be written outside of the user's selected download destination. Path traversal is a technique used to...

PT-2026-65666

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes PUT/POST upload/?mkdir/?delete and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route...

PT-2026-65622

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.1 Description The bulkDownload handler in httpserver/updown.go fails to call findEffectiveACL or applyCustomAuth when processing ZIP downloads via the ?bulk&file= parameter. This allows an unauthenticated network...

CVE-2026-18085: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service...

CVE-2026-12124: Missing Authorization

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...