Malicious code in vite-plugin-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56ca9dc73ad1724cba2621975411cb4f207c06e1526426ef7e257b805ac42800 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

XML External Entity (XXE) Injection

Overview rtc-tools is a Toolbox for control and optimization of water systems. Affected versions of this package are vulnerable to XML External Entity XXE Injection due to unsafe parsing of pathxml. An attacker could potentially exploit this by providing malicious XML input, leading to unauthoris...

Malicious code in mymte (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6027158a0ee580262d47f416e7301411cfb068dfee0c039216f1769129190e63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

Malicious code in carcandofilex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d04f8661d47623c323ee795cb954afb6a58fcaaae0b911beb0f6752004996496 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3515 Malicious code in @baywa-re-lusy/nsemea-customer-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04cade6fe87118ba0ff073c78b84a484c6d2ec20889cf67ea74c255058b7d6e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nsemea-sample-parenttransaction-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a41c3f9782e1fb062bef2307e7300491d25460f761f7e9da305bc92e541c850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3532 Malicious code in nsemea-core-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dad870b6719a7ca56397739f03731e2e597c7008601ef058d93c6b312f6b4725 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3540 Malicious code in webview-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 350de9d57836c502b1910805b2b6d9a4e1f5aad34e121671d5482c073889894a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in metadata-collector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d0c00e28320e5a836d89bb26152ff2b5c4989287285bb5071872ad3413821cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Atlassian Jira 9.12.x < 9.12.22 XML External Entity

According to its self-reported version number, the Atlassian Jira application running on the remote host is 9.12.x prior to 9.12.22. It is, therefore, affected by an XML External Entity XXE vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the...

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

CVE-2025-34490 GFI MailEssentials < 21.8 XXE Arbitrary File Read

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity XXE issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files...

CVE-2025-34490

GFI MailEssentials

Malicious code in graphhopper-js-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 528454d3ceaec479832ef3607c05e7f1a1f58026c1a94fcfb2b3835b952d9c2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b5cad81db450339a0757b061ec3451b681549d64b58b8ef18bb17baf584084d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-18106 · Gfi · Gfi Mailessentials

Name of the Vulnerable Software and Affected Versions: GFI MailEssentials versions prior to 21.8 Description: The issue is related to an XML External Entity XXE problem. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files. Recommendations: For versio...

CVE-2025-24910

Overview XML documents optionally contain a Document Type Definition DTD, which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the...

CVE-2025-24911

Overview XML documents optionally contain a Document Type Definition DTD, which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the...