Malicious code in set7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e2e9040a08a54eb2600701e50e4137fd9959873e23cb5c6c4845e0a4f3f6564 Package downloads and suggest opening an obfuscated script, which is an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Zoo Management System /admin/index.php File SQL Injection Vulnerability

Zoo Management System is a zoo management system. Zoo Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter Username in file /admin/index.php. An attacker can exploit this vulnerability to...

WeGIA Cross-Site Scripting Vulnerability (CNVD-2025-17283)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the index.php endpoint, no details of the vulnerability are provided at this time...

Cyber Cafe Management System /index.php File SQL Injection Vulnerability

Cyber Cafe Management System is an internet cafe management system. Cyber Cafe Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter Username in file /index.php. An attacker can exploit this...

MAL-2025-191683 Malicious code in aphorism-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 95f15b2b497431703ff51667a4055e8172f9202aeeea0f725b0b0550812f3299 Importing the module starts a telegram bot that connects to a chat and executes provided commands --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2025-191885 Malicious code in talbat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa560ce194b853d26b02cc7a6fc99298c2b1de4516a8beb84b84475aa1fb23b3 Importing the module starts a telegram bot that connects to a chat and executes provided commands --- Category: MALICIOUS - The campaign has clearly malicious...

CampCodes Online Movie Theater Seat Reservation System: Code Injection Vulnerability

CampCodes Online Movie Theater Seat Reservation System is an online movie theater seat reservation system from CampCodes Philippines, Inc. A code injection vulnerability exists in version 1.0 of the Campcodes Online Movie Theater Seat Reservation System, which originates from cross-site scripting...

Malicious code in rbx1325382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 966cc45844a609edfa292523c993aa173d39c710d8856c06f30d5d73d82f48e9 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-41735 Malicious code in rbx1325382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 966cc45844a609edfa292523c993aa173d39c710d8856c06f30d5d73d82f48e9 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in rbx1325 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7895e3c185d37126abdb72411a2b02b7d78325ca51e4cecd4303e282608b8966 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-41734 Malicious code in rbx1325 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7895e3c185d37126abdb72411a2b02b7d78325ca51e4cecd4303e282608b8966 During installation, package attempts to exfiltrate browser data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

GHSA-565H-44M8-4C2V xxl-job has Inadequate Encryption Strength

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with...

Malicious code in svcmanager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 062d589e7c49394864a13694f3de2a89589fd2f5e6a4d2e43e35ce136b6e7e9c Package attempts to download an executable and install it as a privileged service. The executable seems to be modified remote access tool --- Category: MALICIO...

Vehicle Parking Management System index.php File SQL Injection Vulnerability

Vehicle Parking Management System is a parking management system. Vehicle Parking Management System suffers from a SQL injection vulnerability that stems from an error in the parameter Username in file /admin/index.php that lacks validation of an externally entered SQL statement. An attacker can...

OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

Impact The lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length is empty i.e. buffer.length == 0 and position is not 2256 - 1 i.e. pos != typeuint256.max. The pos argument could be used...

MAL-2025-191685 Malicious code in avatar-handler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c3750cf8fac7fc22334d1fb416e7f3af691425c669829dcc9857abdc1384bbb7 Code pretending to handling downloading an image, but in fact is prepared to download and execute a Powershell script image properties. No known usage ---...

Malicious code in memorylib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be3ea3afb3553f67411c8bebff9d99282169997e212b5ee1dd14505d1612d551 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...

Malicious code in memtools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fafb3bba871c43e80681f3c9f4618ec7547fe2295b120eb93adf31a59bf021f3 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...

Malicious code in vramx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62a5bfc96a523ea6df6a2539bea5f16b48800c1896ef7fb2df344ed0486e6a49 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...

Malicious code in memlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a0d0e362d3ea9b768078a9e47f80c667acef799c7099f8044e74fd1738fdedb4 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...