Malicious code in feathers-protectpay (npm)

The package feathers-protectpay was found to contain malicious code...

Malicious code in feathers-credstash (npm)

The package feathers-credstash was found to contain malicious code...

MAL-2025-20343 Malicious code in feathers-credstash (npm)

The package feathers-credstash was found to contain malicious code...

MAL-2025-20344 Malicious code in feathers-protectpay (npm)

The package feathers-protectpay was found to contain malicious code...

MAL-2025-20342 Malicious code in feathers-amqp-events (npm)

The package feathers-amqp-events was found to contain malicious code...

CVE-2024-51652

Cross-Site Request Forgery CSRF vulnerability in marckocher Skip To skip-to allows Stored XSS.This issue affects Skip To: from n/a through = 2.0.0...

CVE-2024-51652

CVE-2024-51652 : WordPress plugin Skip To is affected by a CSRF to Stored Cross-Site Scripting (XSS) vulnerability. The CVE description indicates a CSRF flaw that enables Stored XSS in Skip To versions n/a through 2.0.0. Connected sources substantiate the issue for the Skip To plugin and list the...

@agor-live/client (>=0.16.0 <=0.21.1), @b3dotfun/b3-api (>=0.0.2 <=0.0.102) +127 more potentially affected by CVE-2023-37899 via @feathersjs/transport-commons (>=5.0.11 <=5.0.5)

@feathersjs/transport-commons NPM version =5.0.11, =0.16.0, =0.0.2, =0.0.0, =0.0.1-react-native, =0.0.1-alpha.1, =1.0.0, =0.0.10, =5.0.0-pre.0, =0.1.0, =0.1.0, =0.3.1, =0.1.0, =0.4.0-pre.0, =0.4.0-pre.3 and more Source cves: CVE-2023-37899 Source advisory: OSV:GHSA-HHR9-RH25-HVF9...

GHSA-HHR9-RH25-HVF9 Feathers socket handler allows abusing implicit toString

Impact Feathers socket handler did not catch invalid string conversion errors like: ts const message = $ toString: '' Causing the NodeJS process to crash when sending an unexpected Socket.io message like ts socket.emit'find', toString: '' Patches A fix has been released in - v5.0.8 via 3241 -...

Feathers socket handler allows abusing implicit toString

Impact Feathers socket handler did not catch invalid string conversion errors like: ts const message = $ toString: '' Causing the NodeJS process to crash when sending an unexpected Socket.io message like ts socket.emit'find', toString: '' Patches A fix has been released in - v5.0.8 via 3241 -...

Feathers 代码问题漏洞

Feathers is Feathers open source a lightweight Web framework. Used to create APIs and real-time applications using TypeScript or JavaScript. Feathers has a code issue vulnerability , the vulnerability stems from the socket handler does not catch invalid string conversion errors , which can cause...

feathers-sequelize 安全漏洞

feathers-sequelize is a Feathers Ecosystem open source Feathers database adapter for Sequelize. Feathersjs-ecosystem/feathers-sequelize has a security vulnerability , the vulnerability stems from improper attribute filtering , an attacker can use the vulnerability for SQL injection...

feathers-sequelize 安全漏洞

feathers-sequelize is a Feathers Ecosystem open source Feathers database adapter for Sequelize. Feathers Ecosystem feathers-sequelize has a security vulnerability that stems from improper parameter filtering, which can be exploited by attackers for SQL injection...

Prototype Pollution

feathers-sequelize is vulnerable to prototype pollution. The vulnerability exists in the cleanQuery method due to the use of insecure recursive logic to filter unsupported keys from the query object, which allows an attacker to inject malicious properties resulting in prototype pollution...

SQL Injection

feathers-sequelize is vulnerable to SQL Injection attacks. A remote attacker is able to inject arbitrary queries through the $select attribute in find function due to improper input validations...

SQL Injection

feathers-sequelize is vulnerable to sql injection attacks. The vulnerability exists in thefind function of index.js because the parameters are not properly filtered which allows an attacker to inject and execute arbitrary sql queries...

@xrengine/analytics (>=0.4.11 <=5.0.0-beta3), @xrengine/server-core (>=0.4.11 <=5.0.0-beta3) potentially affected by CVE-2022-29823 via feathers-sequelize (=6.3.2)

feathers-sequelize NPM version =6.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on feathers-sequelize and may be impacted: - @xrengine/analytics =0.4.11, =0.4.11, =5.0.0-beta3 Source cves: CVE-2022-29823 Source advisory: OSV:GHSA-P5M3-27VH-52J4...

@xrengine/analytics (>=0.4.11 <=5.0.0-beta3), @xrengine/server-core (>=0.4.11 <=5.0.0-beta3) potentially affected by CVE-2022-2422 via feathers-sequelize (=6.3.2)

feathers-sequelize NPM version =6.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on feathers-sequelize and may be impacted: - @xrengine/analytics =0.4.11, =0.4.11, =5.0.0-beta3 Source cves: CVE-2022-2422 Source advisory: OSV:GHSA-QPV8-4PJQ-QQH7...

@xrengine/analytics (>=0.4.11 <=5.0.0-beta3), @xrengine/server-core (>=0.4.11 <=5.0.0-beta3) potentially affected by CVE-2022-29822 via feathers-sequelize (=6.3.2)

feathers-sequelize NPM version =6.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on feathers-sequelize and may be impacted: - @xrengine/analytics =0.4.11, =0.4.11, =5.0.0-beta3 Source cves: CVE-2022-29822 Source advisory: OSV:GHSA-5HQ7-J5WQ-P227...

GHSA-5HQ7-J5WQ-P227 feathers-sequelize vulnerable to SQL injection due to improper parameter filtering

feathers-sequelize is vulnerable to improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection...