MAL-2025-46472 Malicious code in upgrade-firebase-event-telesto (npm)

The package upgrade-firebase-event-telesto was found to contain malicious code...

Malicious code in event-centaurus-unuk-aquarius (npm)

The package event-centaurus-unuk-aquarius was found to contain malicious code...

Malicious code in scripts-cybernetics-aurora-event (npm)

The package scripts-cybernetics-aurora-event was found to contain malicious code...

MAL-2025-45978 Malicious code in scripts-cybernetics-aurora-event (npm)

The package scripts-cybernetics-aurora-event was found to contain malicious code...

Malicious code in event-atlas-selenium-jest (npm)

The package event-atlas-selenium-jest was found to contain malicious code...

MAL-2025-44177 Malicious code in event-centaurus-unuk-aquarius (npm)

The package event-centaurus-unuk-aquarius was found to contain malicious code...

CVE-2025-58623

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-eventbrite allows DOM-Based XSS.This issue affects Event Feed for Eventbrite: from n/a through = 1.3.2...

CVE-2025-58861

Cross-Site Request Forgery CSRF vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Stored XSS.This issue affects Quick Event Calendar: from n/a through = 1.4.9...

CVE-2025-58861 WordPress Quick Event Calendar Plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Stored XSS.This issue affects Quick Event Calendar: from n/a through = 1.4.9...

CVE-2025-58861

CVE-2025-58861 affects the WordPress plugin Quick Event Calendar (versions n/a–1.4.9). The issue is a Cross-Site Request Forgery (CSRF) vulnerability that enables Stored XSS. CVSS 3.1 base score 7.1 (HIGH) with network attack vector, no privileges required, user interaction required, and impact t...

CVE-2025-58861 WordPress Quick Event Calendar Plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Stored XSS.This issue affects Quick Event Calendar: from n/a through = 1.4.9...

WordPress Quick Event Calendar Plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Quick Event Calendar versions = 1.4.9...

WordPress FAT Event - WordPress Event and Calendar Booking plugin <= 5.15 - Local File Inclusion vulnerability

WordPress FAT Event - WordPress Event and Calendar Booking plugin = 5.15 - Local File Inclusion vulnerability discovered by Jingle Bells in WordPress Plugin FAT Event - WordPress Event and Calendar Booking versions = 5.15...

NestJs-Microservices-POC

NestJS Microservices Proof of Concept A comprehensive demonst...

PT-2025-36200

Name of the Vulnerable Software and Affected Versions: Quick Event Calendar versions n/a through 1.4.9 Description: A Cross-Site Request Forgery CSRF vulnerability exists in WP Corner Quick Event Calendar, which also allows Stored Cross-Site Scripting XSS. Recommendations: Update Quick Event...

Linux Distros Unpatched Vulnerability : CVE-2024-38274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. CVE-2024-38274 Note that Nessus relies on the presenc...

WordPress plugin Quick Event Calendar 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2025-46047

creationtimestamp| type| source ---|---|--- 2025-09-04 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3ly226rxcnh2e...

CVE-2025-26450

In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the default IME due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...

CVE-2025-22425

In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...