CVE-2025-65670

An Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts t...

Mageia: Security Advisory (MGASA-2025-0313)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-4VCF-Q4XF-F48M Better Auth Passkey Plugin allows passkey deletion through IDOR

Summary Affected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using POST /passkey/delete-passkey. Details ctx.body.id is implicitly trusted and used in passkey deletion queries. better-auth applications configured with...

WordPress plugin ProjectList SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. The WordPress ProjectList plugin suffers from a SQL injection vulnerability that stems from insufficient cleaning and escaping of parameter ids, which can be exploited by a...

MAL-2025-191109 Malicious code in ids-enterprise-typings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d2289786c3e4396ada63a5a2651f54fc6a55d011e2b5f8acccb8aa21b11cab The package ids-enterprise-typings was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199141

Malicious code in ids-enterprise-typings npm...

EUVD-2025-199142

Malicious code in ids-enterprise-ng npm...

Malicious code in ids-enterprise-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02ae15f729fa23d65989e0f3873d023de175ecf54bb2b230df46861c246bf7df The package ids-enterprise-ng was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191108 Malicious code in ids-enterprise-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02ae15f729fa23d65989e0f3873d023de175ecf54bb2b230df46861c246bf7df The package ids-enterprise-ng was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191107 Malicious code in ids-enterprise-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eff48b53ace7d90fb4a9c05eb62e2e8e1b6540f5dd4058611b4aa8203057276 The package ids-enterprise-mcp-server was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199144

Malicious code in ids-enterprise-mcp-server npm...

Malicious code in ids-enterprise-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eff48b53ace7d90fb4a9c05eb62e2e8e1b6540f5dd4058611b4aa8203057276 The package ids-enterprise-mcp-server was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199146

Malicious code in ids-css npm...

Malicious code in ids-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050d0a8d9340c416d7410787a1a7b2c5e6cec36eb17bacecca14a2cfbcbf76c5 The package ids-css was found to contain malicious code. Source: ghsa-malware 03812dbf5f0120164f355aae423e3fad2e899eb9164b4468f7fd91844d33b35e Any...

MAL-2025-191106 Malicious code in ids-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050d0a8d9340c416d7410787a1a7b2c5e6cec36eb17bacecca14a2cfbcbf76c5 The package ids-css was found to contain malicious code. Source: ghsa-malware 03812dbf5f0120164f355aae423e3fad2e899eb9164b4468f7fd91844d33b35e Any...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

RockyLinux 9 : shadow-utils (RLSA-2025:20559)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:20559 advisory. shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 Tenable has extracted the preceding description blo...

PT-2025-47660

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions prior to 4.2.9.5 Description The LearnPress – WordPress LMS Plugin for WordPress is affected by a sensitive information disclosure issue. Missing capability checks in the REST endpoint...

EUVD-2025-198254

A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now...