CVE-2025-11160

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes...

CVE-2025-11160 WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes...

WordPress WPBakery Page Builder plugin <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module vulnerability

Stored Cross-Site Scripting via Custom JS Module vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WPBakery Page Builder versions = 8.6.1...

WordPress plugin WPBakery Page Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A security...

Microsoft Playwright Node.js Package < 1.55.1 Spoofing (CVE-2025-59288)

The version of the Microsoft Playwright Node.js Package installed on the remote host is prior to 1.55.1. It is, therefore, affected by a spoofing vulnerability: - Improper verification of cryptographic signature in GitHub allows an unauthorized attacker to perform spoofing over an adjacent networ...

Parse-SDK-JS 安全漏洞

Parse-SDK-JS is an open source developer toolkit for the Parse Platform. A security vulnerability exists in Parse-SDK-JS versions prior to 7.0.0 that originates from the injection of a malicious payload and could lead to the remote execution of arbitrary code...

Prototype Pollution

js-toml is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of user-supplied TOML input during parsing, which allows an attacker to craft malicious TOML data that modifies properties of the global Object.prototype, potentially leading to arbitrary code execution or...

Exploit for Improper Authorization in Vercel Next.Js

CVEs — Exploits/CVE Identifiers Repository A collection of pr...

Happy DOM: VM Context Escape can lead to Remote Code Execution

Escape of VM Context gives access to process level functionality Summary Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE Remote Code Execution attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted...

Malicious code in eslint-js-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6662e6d5b878c4eb877089ca5baf3bd40947a9e14dc394e9f11e935facea5b5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33595

Malicious code in eslint-js-config npm...

MAL-2025-48291 Malicious code in eslint-js-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6662e6d5b878c4eb877089ca5baf3bd40947a9e14dc394e9f11e935facea5b5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview eslint-js-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

WordPress WP Mapbox GL JS Maps plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WP Mapbox GL JS Maps versions = 3.0.1...

RockyLinux 9 : firefox (RLSA-2025:16108)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:16108 advisory. firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component CVE-2025-10527 firefox: thunderbird: Incorrect boundary...

PT-2025-41599

Name of the Vulnerable Software and Affected Versions Happy DOM versions 19 and lower Description Happy DOM, a JavaScript implementation of a web browser without a graphical user interface, contains a security issue that could lead to Remote Code Execution RCE attacks. The Node.js VM Context with...

Malicious Package

Overview js-notifiers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-33625

Malicious code in js-notifiers npm...

Malicious code in js-notifiers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 516c8c2eb1e3c158b2e0c618c03ccee9b71d7aebe439a4ddbe2900a8fc518c7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48243 Malicious code in js-notifiers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 516c8c2eb1e3c158b2e0c618c03ccee9b71d7aebe439a4ddbe2900a8fc518c7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...