Malicious code in mailersend-firebase (npm)

The package mailersend-firebase was found to contain malicious code...

Malicious code in firebase-queue-client (npm)

The package firebase-queue-client was found to contain malicious code...

Malicious code in upload-file-to-firebase (npm)

The package upload-file-to-firebase was found to contain malicious code...

MAL-2025-31291 Malicious code in queue-firebase (npm)

The package queue-firebase was found to contain malicious code...

MAL-2025-27164 Malicious code in nebula-firebase-queue (npm)

The package nebula-firebase-queue was found to contain malicious code...

MAL-2025-17566 Malicious code in cordova-plugin-firebase-lovespace (npm)

The package cordova-plugin-firebase-lovespace was found to contain malicious code...

MAL-2025-20586 Malicious code in firebase-io-taurus-procyon (npm)

The package firebase-io-taurus-procyon was found to contain malicious code...

MAL-2025-26162 Malicious code in meissa-firebase-equinox-docusaurus (npm)

The package meissa-firebase-equinox-docusaurus was found to contain malicious code...

MAL-2025-25792 Malicious code in mailersend-firebase (npm)

The package mailersend-firebase was found to contain malicious code...

Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength due to the HMAC and RSA key lengths used in the JSON Web Signature JWS implementation not meeting recommended security standards. Remediation Upgrade firebase/php-jwt to version 7.0.0 or higher. References...

CVE-2025-5924

The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpnbrodcastnotificationmessage function. This makes it possible for unauthenticated attacker...

CVE-2025-5924

The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpnbrodcastnotificationmessage function. This makes it possible for unauthenticated attacker...

CVE-2025-5924 WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification

The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpnbrodcastnotificationmessage function. This makes it possible for unauthenticated attacker...

CVE-2025-5924

CVE-2025-5924 concerns the WP Firebase Push Notification WordPress plugin (versions

WordPress plugin WP Firebase Push Notification 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2025-27841 · WordPress · Wp Firebase Push Notification

Name of the Vulnerable Software and Affected Versions: WP Firebase Push Notification plugin for WordPress versions prior to 1.2.1 Description: The issue is due to missing or incorrect nonce validation on the wfpn brodcast notification message function, making it possible for unauthenticated...

Malicious code in baileys-cleaner (npm)

The package communicates with a domain associated with malicious activity. It archives /home/container & exfiltrates data to catbox.moe & Firebase, including IP address. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware...

CVE-2024-45489

Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however because of misconfigured Firebase ACLs, it is possible to create or update a boost using another user's ID. This installs the boost in the victim's browser and...

CVE-2024-30564

An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method...

CVE-2024-31215

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s...