CVE-2024-37557

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Soham Web Solution WP Cookie Law Info allows Stored XSS.This issue affects WP Cookie Law Info: from n/a through 1.1...

CVE-2024-4256

A vulnerability was found in Techkshetra Info Solutions Savsoft Quiz 6.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /public/index.php/Qbank/editCategory of the component Category Page. The manipulation of the argument categoryname with the inpu...

CVE-2024-46547

A vulnerability was found in Romain Bourdon Wampserver all versions discovered in v3.2.3 and v3.2.6 where unauthorized users could access sensitive information due to improper access control validation via PHP Info Page. This issue can lead to data leaks...

CVE-2024-54217

Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through = 6.4.1...

CVE-2023-21246

In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-30557

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the datadictionary.py tableinfo. User input coming from the dbname in a...

CVE-2023-51093

Tenda M3 V1.0.0.124856 was discovered to contain a stack overflow via the function fromSetLocalVlanInfo...

CVE-2023-5711

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdphpinfo function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2023-47390

Headscale through 0.22.3 writes bearer tokens to info-level logs...

CVE-2023-27652

An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the updateinfo field of the default.xml file...

CVE-2023-26526

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1...

CVE-2023-26134

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once...

CVE-2023-1961

A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/?page=systeminfo. The manipulation of the argument System Name leads to cross site scripting. It is possible to launch the...

CVE-2023-1634

A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/infodeal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2023-1276

A vulnerability, which was classified as critical, has been found in SUL1SSshop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has be...

CVE-2023-27566

Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file...

CVE-2023-37018

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a UE Capability Info Indication message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...

CVE-2023-24687

Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting XSS vulnerability in the Company Info Settings component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtCompanyName parameter...

MAL-2025-4348 Malicious code in fs-path-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5bbb0034c7f631436e49a1e2a5c4a5f80204c56e46a101701eeb40d7947eb39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in fs-path-info

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...