MAL-2025-105608 Malicious code in marcel-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe8d5e8472ec2548a9fda6643ef7bcdf495d7e6582298a71ef321ae6bfe7f595 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-81296

Malicious code in marcel-soluble-pot npm...

Malicious code in marcel-soluble-pot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5f9602840f1e3c3fdbd5b15a20dcd56a983fd5ad7e2c6be422a5b02614a56b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-81295

Malicious code in marcel-wallet-store npm...

Malicious code in marcel-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe8d5e8472ec2548a9fda6643ef7bcdf495d7e6582298a71ef321ae6bfe7f595 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-7984

Malicious code in bioql PyPI...

EUVD-2023-29397

Malicious code in bioql PyPI...

CVE-2023-23994

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marcel Bootsman Auto Hide Admin Bar plugin = 1.6.1 versions...

CVE-2025-30523

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Marcel-NL Super Simple Subscriptions super-simple-subscriptions allows SQL Injection.This issue affects Super Simple Subscriptions: from n/a through = 1.1.0...

CVE-2024-51678

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

CVE-2024-51678

CVE-2024-51678 affects the WordPress plugin Elo Rating Shortcode (

CVE-2024-51678 WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

CVE-2024-51678 WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

GHSA-VFMV-JFC5-PJJW CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by...

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the improper handling of Content-Type headers when uploading to object storage, including Amazon S3. An attacker can bypass the contenttypeallowlist by providing multiple Content-Type values separated by...

PT-2024-22687 · Amazon · Amazon S3

Name of the Vulnerable Software and Affected Versions: CarrierWave versions prior to 2.2.6 CarrierWave versions prior to 3.0.7 Description: The issue is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by...

CVE-2023-25442

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Marcel Pol Zeno Font Resizer plugin = 1.7.9 versions...

CVE-2023-25442

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Marcel Pol Zeno Font Resizer plugin = 1.7.9 versions...

CVE-2023-25442

CVE-2023-25442 affects the WordPress Zeno Font Resizer plugin up to version 1.7.9. It is a stored XSS vulnerability requiring admin+ authentication. The issue is fixed in version 1.8.0; remediation is to update the plugin to 1.8.0 or later.