CVE-2025-42887

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availabilit...

CVE-2025-42887 Code Injection vulnerability in SAP Solution Manager

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availabilit...

Malicious code in rce-poc-test-honor-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b66eed52fc0c24b51f24da6c244c23fc29ce6228dd4a97a0606f71bb254f02b7 The package rce-poc-test-honor-dev was found to contain malicious code. Source: ghsa-malware...

MAL-2025-49386 Malicious code in tailwindcss-twflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24ae450cb567421e91b0d5a8fbe5904a5136ecfcb74a4a78ad0244beac01d011 The package tailwindcss-twflare was found to contain malicious code. Source: ghsa-malware...

Malicious code in tailwindcss-react-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c6f72d8d64a8612b01ed58fa0bcacd97698a820dcf3b2ebf50dec6e23831065 The package tailwindcss-react-sass was found to contain malicious code. Source: ghsa-malware...

Malicious code in bcryptjs-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0be16faac6783f82014ca8cf99ad85fccf1d5e8a161d5b601a50ae9d6376727 The package bcryptjs-node was found to contain malicious code. Source: ghsa-malware 9ed37910e4f94c2d5eb3552347636ce0b38ce92c42cb7abf643ca2cffd60e8af...

CVE-2025-34501

Deck Mate 2 ships with static, hard-coded credentials for the root shell and web UI, and exposes multiple management services by default (SSH, HTTP, Telnet, SMB, X11). An attacker with local or near-local access (e.g., USB or Ethernet ports under the table) can login as admin and gain full contro...

Malicious code in kingasd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cea57ed478ce7d494e8daba01d75b4c47a41bf4cc2bcce462a405cd46ea1a4 The package kingasd was found to contain malicious code. Source: ghsa-malware 13d287b8649f8ab3c2db046c9db2af68601de7e168725a1440764bd4f6c03400 Any...

CVE-2025-29270

Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device...

Malicious code in custom-tg-bot-plan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10cef01d344d07be2f72b365cb97f994a5cea38eef145b5b25de21f1784cd740 The package custom-tg-bot-plan was found to contain malicious code. Source: ghsa-malware...

CVE-2025-29270

The issue CVE-2025-29270 affects Deep Sea Electronics DSE855 devices, specifically versions 1.1.0 through 1.1.26. The vulnerability is an incorrect access control in the realtime.cgi endpoint, which can allow an attacker to access the admin panel and take full control of the device. The impact is...

Malicious code in ethesjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea9c413600cb75bea29c7e567157efcaa07b76b9efbb30cb378943bd81eb760e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethetsjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbf1d245815ae5573ce88fea42cb604308fd2473b55ebb63f823d33796cff6bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-49082 Malicious code in dizcordjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 679877c4e96760ae7dbd53d81c46c410bb32a9465f3288f9db08b21a127e17c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-49080 Malicious code in deezcord.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77b0b22c2e73948c8b7ddedeeae0ca6a7f28d81809e45d6d3cde8145a08c6d84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dizcordjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 679877c4e96760ae7dbd53d81c46c410bb32a9465f3288f9db08b21a127e17c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-login-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fcdb01161dd908ab60a75665ae19aceaa087fe291da7b8be7c5a7eb44b00011 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-49037 Malicious code in react-naming-convention (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f1de3b293c216a9b6c48e3cdb120f41ef3a161e4aaa7be1aa115440108c0f4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aikido-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52c1bd3edc12ef36437639352924906fec14c56f2696f2ae2cd9e5d9d03522f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @aio-commerce-sdk/config-typedoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7115c3c8e9d8049f239251eeaf99504698b6eea04f36d5490dedff17b173f77b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...