Exploit for CVE-2026-109384

CVE-2026-109384 — IvyForms Author: NØXCRYPT · @noxcrypt-...

CVE-2026-109384

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

EUVD-2026-111750

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

Malicious code in innovative-green-newt (npm)

Source: amazon-inspector 2d7d76f2a7194ec968048ce9d89e5182e8bd1e37ef1505ea1dfd35639ed22f6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in innovative-aqua-scallop (npm)

Source: amazon-inspector 603c8b30f9d7c9fe3557c450993531e0b0f0d062a4508b6e0566ea28a0638f73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in innovative-salmon-toucan (npm)

Source: amazon-inspector 798e62a31dc0b3d5891651bec6311cb78ee41fa059148e4fd2d2b0f0eb4fb5a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in innovative-lavender-roadrunner (npm)

Source: amazon-inspector ec72f5bfba30e96c51554845c6a26c1f998f5349a550828d2379a1dbe7b91675 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in innovative-indigo-guppy (npm)

Source: amazon-inspector 7549d6f57be0f96e1987528f20a5124998f4a4653f8bbbe946ed284d22be4a1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

EUVD-2025-117298

Malicious code in innovative-lavender-roadrunner npm...

EUVD-2025-76549

Malicious code in innovativealligator-excellentdev npm...

EUVD-2025-76548

Malicious code in innovativemarmot-tool npm...

EUVD-2025-79010

Malicious code in innovativecheetahz3n npm...

EUVD-2025-71526

Malicious code in innovativemothz3n npm...

EUVD-2025-63513

Malicious code in innovativecatsharkz3n npm...

Malicious code in innovative_whale_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6ef53749f499220c9bca76a2d896d5b196e7792d0c5133a24d2cdf046e35b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95042 Malicious code in innovative_magpie_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a0df509fdc252b2c92fad7c07f5ac096ea59d4d873adb6c4d46fe478b0d82ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-63511

Malicious code in innovativewhalez3n npm...

EUVD-2025-53742

Malicious code in innovative-indigo-guppy npm...

EUVD-2025-53741

Malicious code in innovative-salmon-toucan npm...

Malicious code in innovative-indigo-guppy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7549d6f57be0f96e1987528f20a5124998f4a4653f8bbbe946ed284d22be4a1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...