Malicious code in nana-tomat53-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39076157f10314d270746fe64d5d23c968f6bc5ac758a1043a75259bd1d26b15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sinta-ikan66-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31bf017402ca51465c6c7501a34c320a5c0f5cbcf2c55490ae0cc54afc0df77c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57930 Malicious code in ocha-kemplang98-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ba35a6be07151fd83f80357e97f40ab786824614b9176e47855171246c7547 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-43079

The Qualys Cloud Agent included a bundled uninstall script qagentuninstall.sh, specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges...

CVE-2025-43079

CVE-2025-43079 concerns Qualys Cloud Agent where the bundled uninstall script qagent_uninstall.sh (Mac/Linux) executes multiple system commands without absolute paths and without sanitizing $PATH. The root cause is reliance on manipulated PATH, enabling a privileged user (root/sudo) with elevated...

CVE-2025-43079 Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents

The Qualys Cloud Agent included a bundled uninstall script qagentuninstall.sh, specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges...

CVE-2025-43079 Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents

The Qualys Cloud Agent included a bundled uninstall script qagentuninstall.sh, specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges...

CVE-2025-12938

A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /processlogin.php. The manipulation of the argument keywords leads to sql injection. The attack can be initiated remotely. The exploit is publicly...

Path Traversal

mllogger is vulnerable to path traversal. the vulnerability is due to manipulation of the File argument in the loghandler function of mllogger/server.py, which allows an attacker to perform path traversal to read, create, or overwrite files remotely...

CVE-2025-12933

CVE-2025-12933 : A SQL injection vulnerability exists in SourceCodester Baby Care System 1.0 due to manipulation of the roleid parameter in /updatewelcome.php?id=siteoptions&action=welcome. The vulnerability can be exploited remotely and a public exploit is available. The connected documents cons...

MAL-2025-54853 Malicious code in sinta-klipo77-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a39c2aafe92fa7a41dd9358e28927c11e75d55d341d812044b4e0de2518faf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-gaplek95-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e9679a4267396cb5686300729aeeb4516fb46a51680ffe95b34c341974c9e11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putra-lupis19-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a37689e6bc239904142623565b774b53e95bfeee0b3b033615c65e29556fe2d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54578 Malicious code in riana-peyek15-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1298a7e15b0606413faf50fca3069978ecc8a521fd24e91fe90c46ecf51e9517 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54583 Malicious code in riana-semur11-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49a72302288f874443032b5bd01deaa651d0566d9aa684baf5342dae55e867b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ogi-klanting57-remi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d59333dc1a627736756182fd5cb0b90d1f9506afe198d3330078f0141e8d678f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in patria-miemee43-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11e31720f32051fddb3985adc14caeb135c8845ca23c67658dbc8bd595368d8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-telur24-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd8c4a80a782361142ff5f3a74c1d627a2c115b8588ff032bc0426263c50f87b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-lepet3-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d357054bec37c192f7fb18af36f8bbd9e2d4ce5c0829c3858d528267da88732 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rudi-tek22-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42e828ecd047361d9e9ec6c10e9d709b856e95bda8d39228bbe6d8954c6e4069 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...