MAL-2025-28220 Malicious code in omni-law-menu-section (npm)

The package omni-law-menu-section was found to contain malicious code...

MAL-2025-16754 Malicious code in ch-react-menu (npm)

The package ch-react-menu was found to contain malicious code...

MAL-2025-31802 Malicious code in react-menu-toolbar (npm)

The package react-menu-toolbar was found to contain malicious code...

Malicious code in multicolumn-menu (npm)

The package multicolumn-menu was found to contain malicious code...

Malicious code in ch-react-menu (npm)

The package ch-react-menu was found to contain malicious code...

Malicious code in omni-law-menu-section (npm)

The package omni-law-menu-section was found to contain malicious code...

Malicious code in react-menu-toolbar (npm)

The package react-menu-toolbar was found to contain malicious code...

MAL-2025-26053 Malicious code in mcp-menu (npm)

The package mcp-menu was found to contain malicious code...

Malicious code in @sellerly-kit/dropdown-menu (npm)

The package @sellerly-kit/dropdown-menu was found to contain malicious code...

MAL-2025-26882 Malicious code in multicolumn-menu (npm)

The package multicolumn-menu was found to contain malicious code...

MAL-2025-9674 Malicious code in @womhla6s/ui-modules-menu (npm)

The package @womhla6s/ui-modules-menu was found to contain malicious code...

CVE-2025-8491

The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsceprmsavemenu function. This makes it possible for unauthenticated attackers to upload a men...

CVE-2025-8491 Easy restaurant menu manager <= 2.0.2 - Cross-Site Request Forgery to Menu Upload

The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsceprmsavemenu function. This makes it possible for unauthenticated attackers to upload a men...

CVE-2025-8491 Easy restaurant menu manager <= 2.0.2 - Cross-Site Request Forgery to Menu Upload

The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsceprmsavemenu function. This makes it possible for unauthenticated attackers to upload a men...

CVE-2025-8491

CVE-2025-8491 concerns the Easy restaurant menu manager plugin for WordPress. The vulnerability is a Cross-Site Forgery (CSRF) due to missing/incorrect nonce validation in the nsc_eprm_save_menu() function, allowing unauthenticated attackers to upload a menu file by tricking an administrator. Aff...

PT-2025-32963 · WordPress · Easy Restaurant Menu Manager

Name of the Vulnerable Software and Affected Versions: Easy restaurant menu manager plugin for WordPress versions prior to 2.0.3 Description: The plugin is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation in the nsc eprm save menu function. This allows...

WordPress plugin Easy restaurant menu manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Easy restaurant menu manager plugin <= 2.0.2 - Cross-Site Request Forgery to Menu Upload vulnerability

Cross-Site Request Forgery to Menu Upload vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Easy pdf restaurant menu upload versions = 2.0.2...

CVE-2025-8528 Exrick xboot getMenuList sensitive information in a cookie

A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible to launch the attack remotely. The...

CVE-2025-52358

A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue allows attackers to inject JavaScript payloads within the error or edit-menu-item parameters which are then executed in the victim's brows...