MAL-2025-77187 Malicious code in candra-semur18-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cec2a012bdb3b6b26879de017c6a3a3173a935ddd08ac855d9025f8b0f691e83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-82161 Malicious code in vina-lengko42-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 751eed1125cd7ddb71cda8a99e674e2fd010ec2d1fd8d260786b34da481780be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12126

CVE-2025-12126 affects The Total Book Project WordPress plugin (versions ≤ 1.0). Root cause: insecure direct object reference due to missing validation of a user-controlled key, enabling authenticated users with Contributor+ privileges to move/delete/create chapters in books not owned by them. Im...

CVE-2025-12126 The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access a...

CVE-2025-11532

CVE-2025-11532 affects the Wisly WordPress plugin (versions

CVE-2025-11532 Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlistid' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists...

CVE-2025-11532 Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlistid' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists...

Malicious code in wati-rendang38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76d742f6d73fcabba5ed942fa6eacb00d0179ebb1282ebb22d5d0e84fcc16577 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-71904 Malicious code in agus-soto56-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d276a345a4bd16c2771d7705b8641eee68df81b111c74444bbb172365edb2f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in budi-donat90-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4c5990d67a760ab0ee983e8132727eef95cdc253e56ffaea01288e77629c6b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fitri-kue78-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1592e85fb4b111d62b0e32ccf3886d329f4b04bb4f90e09dbe8262a234490dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-sambel60-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5718f631eacd8d9b44eb043529771c8b09a80bfafb9e0a999dcad354796b9558 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-saguer6-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58ec287b38558776946c3f7e76bf5bbfa02cbe1d659e487c7935d3fb4ec6c0e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74620 Malicious code in nina-papeda56-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 696e74f915982c30805bfff9fea3fa9d8fc48105032864c499f6676f63696bb1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74999 Malicious code in putri-kue55-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d12b55bd3542146d320020fb8a68328e371a9abc4bee18fd75d5c210fccceaf4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-73262 Malicious code in hadi-tomat11-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b18a19fb025b9ef2059136384cce13fbcc5bf907fdc2163ade296351c933e92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-75006 Malicious code in putri-lengko89-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00e6611fc5fd6e2dc7d0f7572eed952c01169e064740de5135574400cd42a749 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zaki-telurtahu78-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 133881435688e363ddfaae59457ae4969fe62eea9914c0ebc07021f8b82faa22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lutfi-mie12-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa186c9ca7230f79d3269b5a43ffd539b7f319b84edc6f1191fd608346654d67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiki-martabak74-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17b0e356454ea979aa5be7c3af3a016285846afdea5c8f494e33b7921d3895ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...