CVE-2025-23083

With the aid of the diagnosticschannel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage...

CVE-2025-0450 Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-3889 · WordPress · Betheme

Name of the Vulnerable Software and Affected Versions: Betheeme plugin for WordPress versions up to, and including, 27.6.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's custom JS functionality due to insufficient input sanitization and output escaping on...

Malicious code in dbx-js-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2191dabfd9180ad79d00f6678faee7b75417b6a5ee484798bff290a81fa0d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-178 Malicious code in dbx-js-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2191dabfd9180ad79d00f6678faee7b75417b6a5ee484798bff290a81fa0d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-179 Malicious code in dds-js-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e0db7ac7daeb916d2610c7e857e635a24cecf8264c32d39366fc297fcda631d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-168 Malicious code in borsh-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51f002385b3c94048b1a161d8afd15fab61c24c5e54a4a23d9020a22313bd3f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in borsh-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51f002385b3c94048b1a161d8afd15fab61c24c5e54a4a23d9020a22313bd3f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dds-js-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e0db7ac7daeb916d2610c7e857e635a24cecf8264c32d39366fc297fcda631d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-254 Malicious code in uber-direct-js-sdk-examples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30ee8294ed2bcf683f478b647f9919d6b45e0651905c29ada14a3ce392168447 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the Minify JS module in Drupal CMS systems, related to the manipulation of cross-site requests, allows attackers to execute CSRF attacks.

The vulnerability of the Minify JS module in Drupal CMS systems is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack remotely...

Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in crypto-js version 3.1.2

Summary A vulnerability has been identified in Crypto-Js 3.1.2, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2023-46233 DESCRIPTION: Brix crypto-js could allo...

CVE-2024-13304

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13304

The CVE-2024-13304 issue affects the Drupal Minify JS module (versions 0.0.0 up to, but not including, 3.0.3). The root cause is unprotected administrator routes enabling Cross-Site Request Forgery (CSRF) attacks. The documented impact is CSRF risk affecting module functionality; remediation is t...

CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery CSRF vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3...

CVE-2024-56243

Missing Authorization vulnerability in JS Morisset WPSSO Core wpsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSSO Core: from n/a through = 18.18.1...

CVE-2024-56243 WordPress WPSSO Core plugin <= 18.18.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in JS Morisset WPSSO Core wpsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSSO Core: from n/a through = 18.18.1...

Malicious code in js-dos-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d534d9ec05d6809f40b3db232c0e24e612234ca30b7d46155b7aa6043c7d02a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...