MAL-2025-142997 Malicious code in graphql-chai-schema-elara (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8815d1a4d4f17193b365dff9a9095f12e31e182c8b4d9189ceeeb9f15874d46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146031 Malicious code in pegasus-graphql-playwright-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9485849dcf43ce232720e15f229be2925398be484ea117e2cc67c5e107784b5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148075 Malicious code in solis-graphql-figures-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45612d2418157df1b47f3b420231aaaf83a4363bb4a5c2aa3eed9c095e71deb0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121607

Malicious code in stream-graphql-levels-sedna npm...

EUVD-2025-113118

Malicious code in graphql-altair-antares-juno npm...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site scripting issue in k8s proxy impacts GitLab CE/EE Incorrect Authorization issue in workflows impacts GitLab EE Information Disclosure issue in GraphQL subscriptions impacts GitLab CE/EE Information Disclosure issue in access control impacts GitLab CE/EE Prompt Injection...

CVE-2025-64493

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493

In SuiteCRM versions 8.6.0–8.9.0, an authenticated, blind (time-based) SQL injection exists in the appMetadata operation of the GraphQL API, allowing extraction of arbitrary data without admin access. Affected component: GraphQL API, operation appMetadata. Root cause: improper handling/validation...

SuiteCRM SQL注入漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. A SQL injection vulnerability exists in SuiteCRM versions 8.6.0 through 8.9.0, which stems from an authenticated time-based SQL injection in the appMetadata-operation of the GraphQL-API, which could lead to arbitrary da...

This Week in Spring - November 4th, 2025

Hi, Spring fans! Welcome to another all-out installment of This Week in Spring wherein we attempt to recap all that's new and novel in the wild, wacky, and wonderful world of Springdom. And this week, I'm doing so from an airport in Switzerland, en route to Malmo, Sweden, for the amazing Oredev...

MAL-2025-49153 Malicious code in epic-graphql-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cd084bb1d953fdf618916ebe2971c48ec09222cefe2ffde4698ef07d373707f The package epic-graphql-schema was found to contain malicious code...

EUVD-2025-37139

Malicious code in epic-graphql-types npm...

MAL-2025-49154 Malicious code in epic-graphql-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c376798a5627e484210f37b857fe51b897583a6b740cd5acaff21bac776d12d5 The package epic-graphql-types was found to contain malicious code...

MAL-2025-49111 Malicious code in egstore-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f78f2a6abccca4b462d391732c3bc43094be0be51d4d3cc06a1686d1b554e The package egstore-graphql-client was found to contain malicious code...

EUVD-2025-37140

Malicious code in epic-graphql-schema npm...

Malicious code in egstore-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f78f2a6abccca4b462d391732c3bc43094be0be51d4d3cc06a1686d1b554e The package egstore-graphql-client was found to contain malicious code...

Malicious code in epic-graphql-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cd084bb1d953fdf618916ebe2971c48ec09222cefe2ffde4698ef07d373707f The package epic-graphql-schema was found to contain malicious code...

Malicious code in epic-graphql-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c376798a5627e484210f37b857fe51b897583a6b740cd5acaff21bac776d12d5 The package epic-graphql-types was found to contain malicious code...