CVE-2025-64747

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...

CVE-2025-64747 Directus Vulnerable to Stored Cross-site Scripting

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...

CVE-2025-64747

CVE-2025-64747 describes a stored XSS in Directus prior to version 11.13.0. Attackers with upload files and edit item permissions can inject JavaScript via the Block Editor interface. The technique exploits insufficient sanitization and uses an iframe with a srcdoc attribute to bypass CSP, enabli...

CVE-2025-64747 Directus Vulnerable to Stored Cross-site Scripting

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...

PT-2025-46912

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0 Description Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS issue exists that allows users with upload files and edit item permissions to...

Malicious code in item-atim-ku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b69c3dcc16fdf9ee876642a7dde0e74d202652e098c76bf7f4712eb37dd502 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-at-labigka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8adf8c58089d29307335b8e57d85b4be2f4f44eaaf028f5af171be49215e1ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-atm-kujoloi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8455fd4274803044fae51d2b3b49fdc3f5c34fb4e1fec7c2b7fae9e768c5cf97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-atm-kujaulahubi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fedba93dcbf0f1a15f6b494170abae6b4a64911ae5ebf62a8a9ae7306fde8b7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-atm-kujauhubi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e30bceed700188a6e10d0d10d9ab9feac0f233879ff9faf9681e7aeccbb78809 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-atm-kujolnoi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7f8851960b780baaa05804300d2f7920b4bfc17a9939c779e043532ba685386 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-at-labieagyeyaka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69a80d4f4ce8e3335b765b8c05a6501d6bd9ee3ca2590ed5126e5db38e73a97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-at-labieoka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b080c8a6352d1152a4dce40617d2a1fdd339bd7863fd683a647aa7630d1b21f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-atm-kujoliaknoi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95145fe80d7694cce69d083db5dffa96339896d5652301522bdaf4dc06309de2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-atim-kujaulahubi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72a30bc68f372e5170f6966a3a847107ab68b8a023b8b584e0c02f74cc5caa96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-ati-labiomiza (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1f18d06616a1acaf5fe7967d42dcd8d66be2de04b6375187d00e8fb57cd6b1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-at-labieagyeyabbjpka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c0674428dca91095609e29a55d87745d3b36ad5111086959eb6ae2b2cd416e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-at-oka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ca49ccfef66e849e8e8b80b9658b092468a630b9bb4fae0c1650e25c769b5a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-at-labka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87745aaac0357ce2091df305d10cd849015782459c4c10a20face3f7bf597d12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-ati-kubusiduzika (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e235fcb48b41d699c5c135e74b0631de4d64ae1b6d0a3f95333434525d4e70a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...