MAL-2025-142060 Malicious code in enif-react-bootstrap-gravity-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7366c6b2b849d14ce39d70c33c2606bc5ee97e6c0656befc2c46757026a36cf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143026 Malicious code in gravity-gridsome-equinox-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4084b8a79dc6e11f6c86a344031dbaf4ba059ec5ef8d2e89110dcae2b9a3ff5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143021 Malicious code in gravity-chariklo-library-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760633396d9626e1446ca9c941b2341fd8bf903b955e6bd238487ca4d258e29c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146327 Malicious code in polaris-cache-geckodriver-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4aabbeb70ac312a861cee080d883f38c47e8b66b9d9798c90eda84e2aad74baa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120306

Malicious code in xanthus-halley-gravity-mutation npm...

EUVD-2025-120741

Malicious code in vortex-pino-pretty-gacrux-gravity npm...

EUVD-2025-120693

Malicious code in vulcan-gravity-carina-centauri npm...

Malicious code in bunyan-nestjs-gravity-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a2945766e719b272c5befa7d59051355b159245ccff670eefbedbfc435046b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gravity-gridsome-equinox-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4084b8a79dc6e11f6c86a344031dbaf4ba059ec5ef8d2e89110dcae2b9a3ff5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-115332

Malicious code in chromedriver-init-puppeteer-gravity npm...

EUVD-2025-124732

Malicious code in morgan-regulus-xenon-gravity npm...

EUVD-2025-115891

Malicious code in bulma-gatsby-gravity-css-loader npm...

WordPress Gravity Forms plugin arbitrary file upload vulnerability

WordPress Gravity Forms plugin is a professional forms plugin for the WordPress platform, mainly used to create and manage various interactive forms, supporting data collection, payment processing, workflow automation and other features. WordPress Gravity Forms plugin has an arbitrary file upload...

CVE-2025-12352

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

CVE-2025-58636

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through = 1.2.3...

CVE-2025-49905

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginsCafe Range Slider Addon for Gravity Forms range-slider-addon-for-gravity-forms allows Reflected XSS.This issue affects Range Slider Addon for Gravity Forms: from n/a through = 1.1.6...

CVE-2025-48330

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows PHP Local File Inclusion.This issue affects Real Time Validation for Gravity Forms...

CVE-2025-12352

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

CVE-2025-12352 Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

CVE-2025-12352

The Gravity Forms plugin for WordPress (all versions up to and including 2.9.20 ) is vulnerable to unauthenticated arbitrary file upload due to missing file type validation in the copy_post_image() function. This can lead to remote code execution on affected servers. Exploitation requires allow_u...