MAL-2025-510 Malicious code in linkedin-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a93b00bc04ea5218384795d0a4ce28aef30047e797c5bfa33e15d2e7b799011 The OpenSSF Package Analysis project identified 'linkedin-analytics' @ 999.9.9 npm as malicious. It is considered malicious because: - The packa...

Malicious code in linkedin-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a93b00bc04ea5218384795d0a4ce28aef30047e797c5bfa33e15d2e7b799011 The OpenSSF Package Analysis project identified 'linkedin-analytics' @ 999.9.9 npm as malicious. It is considered malicious because: - The packa...

Malicious code in linkedin-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8001032baa9e57ffc08d11ae9dc0a51fb41ef1dbd5dad53d1a82d828eba3005e The OpenSSF Package Analysis project identified 'linkedin-admin' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-509 Malicious code in linkedin-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8001032baa9e57ffc08d11ae9dc0a51fb41ef1dbd5dad53d1a82d828eba3005e The OpenSSF Package Analysis project identified 'linkedin-admin' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in linkedin-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d3117b6de9634e8866bcc81a60b2d016dc3f6ad89a592ae3118460e5dacc6d31 The OpenSSF Package Analysis project identified 'linkedin-event' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-515 Malicious code in linkedin-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d3117b6de9634e8866bcc81a60b2d016dc3f6ad89a592ae3118460e5dacc6d31 The OpenSSF Package Analysis project identified 'linkedin-event' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

CVE-2025-23897

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows DOM-Based XSS.This issue affects Apply with LinkedIn buttons: from n/a through = 2.3...

CVE-2025-23898

Cross-Site Request Forgery CSRF vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows Stored XSS.This issue affects Apply with LinkedIn buttons: from n/a through = 2.3...

CVE-2025-23897 WordPress Apply with LinkedIn buttons plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows DOM-Based XSS.This issue affects Apply with LinkedIn buttons: from n/a through = 2.3...

WordPress Apply with LinkedIn buttons plugin <= 2.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Apply with LinkedIn buttons versions = 2.3...

WordPress Apply with LinkedIn buttons plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Apply with LinkedIn buttons versions = 2.3...

WordPress plugin Apply with LinkedIn buttons 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-23897: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows DOM-Based XSS.This issue affects Apply with LinkedIn buttons: from n/a through = 2.3...

PT-2025-5180 · Ivo Brett · Applymetrics Apply With Linkedin Buttons

Name of the Vulnerable Software and Affected Versions: Ivo Brett – ApplyMetrics Apply with LinkedIn buttons versions n/a through 2.3 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for DOM-Based XS...

CVE-2025-23898: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows Stored XSS.This issue affects Apply with LinkedIn buttons: from n/a through = 2.3...

Lazarus Group Targets Web3 Developers with Fake LinkedIn Profiles in Operation 99

The North Korea-linked Lazarus Group has been attributed to a new cyber attack campaign dubbed Operation 99 that targeted software developers looking for freelance Web3 and cryptocurrency work to deliver malware. "The campaign begins with fake recruiters, posing on platforms like LinkedIn, luring...

CVE-2023-24375: Missing Authorization

Missing Authorization vulnerability in miniOrange WordPress Social Login and Register Discord, Google, Twitter, LinkedIn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register Discord, Google, Twitter, LinkedIn: from n/a...

CVE-2023-25455: Missing Authorization

Missing Authorization vulnerability in miniOrange WordPress Social Login and Register Discord, Google, Twitter, LinkedIn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register Discord, Google, Twitter, LinkedIn: from n/a...

North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn

The North Korea-linked threat actor known as Sapphire Sleet is estimated to have stolen more than $10 million worth of cryptocurrency as part of social engineering campaigns orchestrated over a six-month period. These findings come from Microsoft, which said that multiple threat activity clusters...

A week in security (October 21 &#8211; October 27)

Last week on Malwarebytes Labs: 100 million US citizens officially impacted by Change Healthcare data breach Pinterest tracks users without consent, alleges complaint After concerns of handing Facebook taxpayer info, four companies found to have improperly shared data LinkedIn bots and spear...