CVE-2018-18387

CVE-2018-18387 playSMS = 1.4.2 - Privilege escalation TMHC TEAM found a vulnerability that lead to a priviledge escalation through playSMS/web/init.php that can lead to a complete system compromise. The attacker need to get access on the box where playSMS is installed and be able to edit playSMS...

Malicious code in illusion-datalab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6004785b370b58ab360f70d7959fad47ec55ec609e8556217976fc405a610b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ashwesker-CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” Una vulnerabilidad crítica sin autenticación que permite el compromiso total de los servidores n8n 🆔 Resumen Campo| Detalles ---|--- ID CVE| CVE-2026-21858 Nombre en clave| Ni8mare Gravedad| 🔴 Crítica Puntuación CVSS| 10.0 Máxima Vector de ataque| 🌐 Red Autenticación...

CVE-2026-21017-LDAP-Anonymous-Bind-Privilege-Escalation

CVE-2026-21017 – Escalada de Privilegios por Bind Anónimo LDAP Código del programa simulación Python ldap3 ldapanonsim.py - LDAP server allowing anonymous bind with write access from ldap3 import Server, Connection, ALL Simulated: real server would be misconfigured server =...

CVE-2025-32206

CVE-2025-32206 - WordPress Processing Projects "Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects allows attackers to upload a web shell to a web server. This can lead to full compromise." 🧑‍💻 Exploit Description This Python exploit script targets WordPress...

Malicious code in @cat-gen/materia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 354c3f4dedaabc169ba0f7a5ccb99a5a77e7ef99c194854add673e7dac98d30f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17334 Malicious code in @cat-gen/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f0e3ea6c673017f0f5d62fae924a120e25e8ecc3e69abba2e93042eea5d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cat-gen/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f0e3ea6c673017f0f5d62fae924a120e25e8ecc3e69abba2e93042eea5d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @redman89405/my-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58f8e0d965e65d298a38295487ebe0c363ea7da343649827903915cc655f3730 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iban-validator-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fff3da0c4ead2e4f938efa16ad1cea92e872789a3b012edfed68526898cce4fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17284 Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17283 Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in img-to-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7676788d88c2194b8d5c048decfbe06550798ce342af54f8975bc26422d10c53 On require of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended afte...

MAL-2026-17216 Malicious code in img-to-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7676788d88c2194b8d5c048decfbe06550798ce342af54f8975bc26422d10c53 On require of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended afte...

Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...

MAL-2026-17218 Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...

MAL-2026-17219 Malicious code in nebula-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0ca45fda7abd51edfeef37be6d19b4070788180b7625f16354223d81dae4d45 The preinstall.cjs lifecycle script embeds a base64-encoded, zlib-compressed Windows PE 257KB as a string literal. On npm install, the script decodes...

MAL-2026-17220 Malicious code in nebulajs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07debd960454b52639fee783e21c0c303702d8dce6de5e3320393f1b0abc7077 package.json declares scripts.preinstall = 'node preinstall.cjs'. preinstall.cjs is a single 232KB opaque Function... invocation containing a custom...

Malicious code in vite-plugin-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ee82c069dcdf259199f5844c6ff46be3020d79609ff7b7b8ebc82017c59b2c [email protected] exposes a Vite plugin factory whose body concatenates three option fields — secret, salt, and iv — into a single string and...

MAL-2026-17222 Malicious code in vite-plugin-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ee82c069dcdf259199f5844c6ff46be3020d79609ff7b7b8ebc82017c59b2c [email protected] exposes a Vite plugin factory whose body concatenates three option fields — secret, salt, and iv — into a single string and...