MAL-2025-139478 Malicious code in apex-frontend-jasmine-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffd8b8ccab7799216be46b4cf2e947e5092a34b8055fdaf5a7de01224ce7b9dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11997

The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wplocalizescript without prope...

EUVD-2025-60957

The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wplocalizescript without prope...

CVE-2025-11997

The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wplocalizescript without prope...

CVE-2025-11997 Document Pro Elementor – Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure

The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wplocalizescript without prope...

CVE-2025-11997 Document Pro Elementor – Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure

The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wplocalizescript without prope...

CVE-2025-11997

CVE-2025-11997 affects the WordPress plugin Document Pro Elementor – Documentation & Knowledge Base. The root cause is information exposure via frontend JS: Algolia API keys are exposed through wp_localize_script without proper access controls, enabling unauthenticated users to view keys in page ...

PT-2025-46269

Name of the Vulnerable Software and Affected Versions Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress versions prior to 1.1.0 Description The plugin exposes sensitive Algolia API keys through the frontend JavaScript code via wp localize script without proper access...

CVE-2025-12916

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...

CVE-2025-12868

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...

CVE-2025-12868 CyberTutor｜New Site Server - Use of Client-Side Authentication

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website...

Malicious code in post-purchase-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-49731 Malicious code in post-purchase-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

EUVD-2025-38729

Malicious code in post-purchase-frontend npm...

EUVD-2025-38438

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...

Malicious code in frontend-vue-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474 package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script collects system identity...

EUVD-2025-38420

Malicious code in frontend-vue-next npm...

MAL-2025-49410 Malicious code in frontend-vue-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474 package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script collects system identity...

EUVD-2025-38432

Malicious code in bf-purchases-frontend-web npm...

CVE-2025-12916 Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...