7661 matches found
MAL-2026-14138 Malicious code in optimizely-starter-kit-for-fastly-compute (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...
WordPress WP Directory Kit plugin < 1.5.6 - Subscriber+ SQL Injection via section Parameter vulnerability
Subscriber+ SQL Injection via section Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.6...
WordPress WP Directory Kit plugin < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category vulnerability
Unauthenticated SQL Injection via searchlocation and searchcategory vulnerability discovered by Pedro Pinho in WordPress Plugin WP Directory Kit versions 1.5.6...
CVE-2026-18653
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653
The WP Directory Kit WordPress plugin (versions before 1.5.7 ) is vulnerable to SQL injection because it fails to sanitize and escape a parameter used in a SQL statement. This vulnerability allows administrators to perform SQL injection attacks. In a multisite installation , an administrator of a...
CVE-2026-18653
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653 WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
EUVD-2026-59912
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653 WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
PT-2026-73120
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
MAL-2026-14086 Malicious code in kit-hydration-vim (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a567c1c96e08fd606b2ca35ed717ce91df9d0955d4f4c8e0bc747603b2c538e9 On require/import, dist/index.mjs chmods 0755 and spawns the bundled ELF dist/internal/calc.dat as a detached child process. The binary is a full...
Malicious code in kit-hydration-vim (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a567c1c96e08fd606b2ca35ed717ce91df9d0955d4f4c8e0bc747603b2c538e9 On require/import, dist/index.mjs chmods 0755 and spawns the bundled ELF dist/internal/calc.dat as a detached child process. The binary is a full...
GO-2026-5736 vulnerabilities
Vulnerabilities for packages: rancher-support-bundle-kit, dapr-fips, juicefs, dapr, multicluster-controlplane, multicluster-controlplane-fips, milvus, etcd, kcp-fips, kcp...
WordPress Patterns Kit plugin <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link vulnerability
Contributor+ Stored XSS via YouTube Popup Link vulnerability discovered by testoun in WordPress Plugin Patterns Kit versions = 1.0.3...
Malicious code in @leonardo0902/vortex-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9 The main module in @leonardo0902/[email protected] issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passe...
Malicious code in vexium-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9 On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credit...
Malicious code in ventra-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f023d55f53d30a92c8f06ca661862ee99d338f6d3719247c9390b3169009702 The package's default export module.exports = = getPlugin issues an HTTPS request to a hardcoded bare-IP host at 31.97.137.157:45000/icons/116 and...
Malicious code in velora-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb [email protected] exports a getPlugin function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and...
MAL-2026-13961 Malicious code in velora-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb [email protected] exports a getPlugin function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and...