4801 matches found
PT-2025-46269
Name of the Vulnerable Software and Affected Versions Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress versions prior to 1.1.0 Description The plugin exposes sensitive Algolia API keys through the frontend JavaScript code via wp localize script without proper access...
CVE-2025-12916
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...
CVE-2025-12868
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...
CVE-2025-12868 CyberTutor｜New Site Server - Use of Client-Side Authentication
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...
Malicious code in post-purchase-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...
MAL-2025-49731 Malicious code in post-purchase-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...
EUVD-2025-38729
Malicious code in post-purchase-frontend npm...
EUVD-2025-38438
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...
EUVD-2025-38420
Malicious code in frontend-vue-next npm...
Malicious code in frontend-vue-next (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474 package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script collects system identity...
MAL-2025-49410 Malicious code in frontend-vue-next (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474 package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script collects system identity...
EUVD-2025-38432
Malicious code in bf-purchases-frontend-web npm...
CVE-2025-12916 Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...
CVE-2025-12916 Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...
CVE-2025-12916
CVE-2025-12916 affects Sangfor Operation and Maintenance Security Management System 3.0, specifically the Frontend component’s /fort/portal_login. The vulnerability arises from manipulating the loginUrl argument, enabling remote command injection. Public disclosures indicate exploitation is possi...
MAL-2025-49398 Malicious code in bf-purchases-frontend-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5dd380729ba06ecc83dd6bb54612311d4c2b15fc0b2eed47205416bf280f879 The package bf-purchases-frontend-web was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in bf-purchases-frontend-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5dd380729ba06ecc83dd6bb54612311d4c2b15fc0b2eed47205416bf280f879 The package bf-purchases-frontend-web was found to contain malicious code. Source: ossf-package-analysis...
PT-2025-45573
Name of the Vulnerable Software and Affected Versions Sangfor Operation and Maintenance Security Management System versions prior to 3.0.11 Description A command injection issue exists in the Sangfor Operation and Maintenance Security Management System. The issue is related to the manipulation of...
3rd-party-cpu-abuser (>=1.0.0, <=1.4.0), @2lkit/devtools (0.0.1-0) +163 more potentially affected by CVE-2025-12909 via chrome-devtools-frontend (>=1.0.377119-1, <=1.0.746710)
chrome-devtools-frontend NPM version =1.0.377119-1, =1.0.0, =1.2.2-beta, =0.1.0, =0.1.0, =0.0.1, =1.0.0, =1.3.0-1, =1.0.1, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-12909 Source advisory: SNYK:JS-CHROMEDEVTOOLSFRONTEND-13865282...
Access Control Bypass
Overview chrome-devtools-frontend is a Chrome DevTools UI Affected versions of this package are vulnerable to Access Control Bypass due to insufficient Content Security Policy enforcement in the Network.loadNetworkResource method of the DevTools protocol network handler. An attacker can exfiltrat...