MAL-2025-69445 Malicious code in miyool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afa95da6580df72388a2b491f52c1756c733e7383660348c461a4a412f66ace2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68924 Malicious code in intact-beige-jaguar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f40bd00df3fa14afd0e27eb130a607639db01e259743e98838e97a8d424ad0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inadequate-teal-shrimp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c634bbb2a7ec8a5a8b68c26702cd247255594cd5ef8c755b3d6814212b475bbf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lutfi-ronde30-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed0b01a8b20418689eb971e58a903dc99e0b5594480c315f50209caed450c894 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in citra-pisang92-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e9e1b095991fc591639ebde56fe55c71a36c37304fc04d0e62e2295f6cf508c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64888 Malicious code in putri-getuk90-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf337a4ecd96922bad95d958b9cd70446883fdf71f1ed0b68baa6c2173d491e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12920

A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-47286 Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on i...

MAL-2025-60855 Malicious code in mild_magpie_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 082fde5eea7cea7279678d1050364a333a8641fdaa12e6d715b8328b97cdd08b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60937 Malicious code in net_magpie_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ea66672534852503e12944d4b5caabdfda8bb0a9090c0f874613b41441e2b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in appropriate_ladybug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 548e6d038f63220eea41978c8f802ca6c7a8cf2c2e034b9ebb9018110d4d5909 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57107 Malicious code in joni-papeda71-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d80db9ea43b6ebce376284a2bb1aa2fe31b5004ddf66ed64b8cc088b4943da5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in galih-tahu69-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11e8266cedc06999b057169fc333689334a98fc338328939d8a31b77840004c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-serimuka48-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dfbe0ad107df687402b3e36c280f85508944d4aa7ef81b6ee9e1fa6f4c1e43a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-55436 Malicious code in budi-kemplang26-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7012109ea81e7e5699af8000c17146371647fabea8c87d09d8d1b54f32b8b701 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52022 Malicious code in hadianto-kue21-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68536448e252b124267f54601fddd284553bcb629a828bd21db6109d399f435c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Combodo iTop 跨站脚本漏洞

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for the daily operation of IT environments. The program provides incident management, configuration management and problem management. A cross-site scripting vulnerability exists in Combodo iT...

PT-2025-46184

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2 Description Combodo iTop, a web-based IT service management tool, is susceptible to cross-site scripting when a dashboard is edited through an AJAX call. This allows fo...

CVE-2025-62802

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most...

📄 RiteCMS 3.1.0 Remote Code Execution

RiteCMS version 3.1.0 suffers from an authenticated remote code execution vulnerability. Exploit Title: RiteCMS 3.1.0 - Authenticated Remote Code Execution RCE Date: 2025-10-26 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/handylulu/RiteCMS Software Link:...