Malicious code in vite-plugin-js-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 623ab60cdb0568726940f6f7f51b62cad9f69bd835cbf4e9a0fcbda0530a307c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-4979

A cross-site scripting XSS vulnerability exists in Sitecore Experience Platform XP 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platfor...

zip

This is a robust ZIP decoder with defenses against various types of malicious archive signatures, including dangerous compression ratios, spec deviations, and ambiguous UTF-8 filenames. The decoder is implemented in JavaScript and is designed to be used in a Node.js environment. It provides a ran...

MAL-2025-6240 Malicious code in xp-anti-fraud-js-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f4628140ad8ca2bfe8fde97530e932f9f26df49b3841157bc7f8aa50535e77f7 The OpenSSF Package Analysis project identified 'xp-anti-fraud-js-lib...

Malicious code in xp-anti-fraud-js-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f4628140ad8ca2bfe8fde97530e932f9f26df49b3841157bc7f8aa50535e77f7 The OpenSSF Package Analysis project identified 'xp-anti-fraud-js-lib...

MAL-2025-6219 Malicious code in react-international-phone-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55dc391aa3ec3a479f332033f4ed1c9804c98935cd8ec931e830a8f44a9b790f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Joomla JS Jobs plugin 1.4.2 - SQL injection

Exploit Title: Joomla JS Jobs plugin 1.4.2 - SQL injection Google Dork: n/a Date: 07/07/2025 Exploit Author: Adam Wallwork Vendor Homepage: https://joomsky.com/ Demo: https://demo.joomsky.com/js-jobs/jm/free/ Software Link: https://extensions.joomla.org/extension/js-jobs/ Version: v1.4.2 Tested o...

CVE-2025-49484

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

AZL-65606 CVE-2025-7783 affecting package js-jquery 3.5.0-4

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

CVE-2025-49484

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

CVE-2025-49484

The CVE-2025-49484 issue affects the Joomla JS Jobs plugin (versions 1.0.0–1.4.1) from Joomsky. A SQL injection is achievable through the cvid parameter in the employee application workflow, allowing low-privilege users to execute arbitrary SQL commands. The vulnerability stems from improper hand...

CVE-2025-49484 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

CVE-2025-49484 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

PT-2025-30021 · Joomla · Js Jobs Plugin

Name of the Vulnerable Software and Affected Versions: JS Jobs plugin for Joomla versions 1.0.0 through 1.4.1 Description: A SQL injection vulnerability in the JS Jobs plugin for Joomla allows low-privilege users to execute arbitrary SQL commands via the cvid parameter in the employee application...

Joomsky JS Jobs SQL注入漏洞

Joomsky JS Jobs is a Joomla Content Management System CMS based recruitment management plugin from Joomsky. A SQL injection vulnerability exists in Joomsky JS Jobs versions 1.0.0 through 1.4.1, which stems from an incorrect manipulation of the parameter cvid resulting in a SQL injection attack...

Multer 安全漏洞

Multer is an expressjs open source middleware for Node.js. A security vulnerability exists in Multer versions 1.4.4-lts.1 through prior to 2.0.2, which stems from an unhandled exception in the handling of malformed multipart upload requests, which could lead to a denial of service...

CVE-2025-5284

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

CVE-2025-5284 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

Malicious code in js-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c09298c7090e31085be2d84c4a20270bccb912a70ec51629645b45d635b361b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5926 Malicious code in js-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c09298c7090e31085be2d84c4a20270bccb912a70ec51629645b45d635b361b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...