MAL-2025-186201 Malicious code in cold-old-monitor-zeta-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f605ed4e638cfcb600b10d7ae557001f37d7c6fcbb1353943a4f09ea29689a88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190483 Malicious code in zeta-try-stack-alert-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ae4c0f872d31213b4fb2f6cb917a89f8c70d5324e237c9c3dec9617b9b4dddb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cold-hot-beta-log-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9a7f8a4e041fa30770c77c28ed0ed77e8a0b512d546aac9d12dff4a25c02072 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187478 Malicious code in init-parcel-run-script-hugo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 258bb21c3a3de866aaa23cbb8d387c7def0f1812acd17a8cd69e306b229a92b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189141 Malicious code in regulus-xenos-yonder-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b135b3fdeffeb1046ea488a1df925b755f80e5b13d69521ae1c97a1203a438a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46781

Name of the Vulnerable Software and Affected Versions Survey Maker plugin for WordPress versions up to and including 5.1.9.4 Description The software is susceptible to unauthorized data modification. This is due to a missing capability check within the deactivate plugin option function. This allo...

WordPress plugin Gallery Plugin for WordPress – Envira Photo Gallery 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. WordPress plugin...

PT-2025-46897

Name of the Vulnerable Software and Affected Versions Dell Alienware Command Center versions prior to 6.10.15.0 Description Dell Alienware Command Center 6.x has an issue involving insecure temporary files. A local attacker with limited privileges could potentially modify information...

T-INNOVA Deporsite 安全漏洞

T-INNOVA Deporsite is an application from T-INNOVA, Inc. A security vulnerability exists in T-INNOVA Deporsite that stems from an insecure direct object reference that could lead to unauthorized resource access or modification...

PT-2025-46818

Name of the Vulnerable Software and Affected Versions Envira Photo Gallery versions up to and including 1.12.0 Description The Envira Photo Gallery plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check in several functions. Authenticated...

PT-2025-46793

Name of the Vulnerable Software and Affected Versions Convert WebP & AVIF | Quicq versions prior to 2.0.1 Description The Convert WebP & AVIF | Quicq WordPress plugin is susceptible to unauthorized data modification. This is due to a missing capability check on the wp ajax wpqai disconnect quicq...

WordPress plugin quicq 安全漏洞

WordPress quicq plugin is an image optimization tool designed for WordPress that automatically compresses and resizes images to improve website performance. A missing capability check vulnerability exists in WordPress quicq plugin, which can be exploited by attackers to cause unauthorized data...

WordPress plugin Survey Maker 安全漏洞

WordPress Survey Maker plugin is a tool for creating questionnaires with support for multiple question types and data analysis features for businesses or individuals to collect user feedback. WordPress Survey Maker plugin suffers from a missing capability check vulnerability, which stems from a...

HP Integrated Lights-Out Improper Input Validation (CVE-2022-28633)

A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file...

HP Integrated Lights-Out Improper Input Validation (CVE-2016-4375)

Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 aka iLO 3 firmware before 1.88, Integrated Lights-Out 4 aka iLO 4 firmware before 2.44, and Integrated Lights-Out 4 aka iLO 4 mRCA firmware before 2.32 allow remote attackers to obtain sensitive information, modify data, or cause...

Malicious code in avangi-ogolia-iualim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c0fea4fd78dd3b54e429d00ad10b0d377e2c6ee3b6c934b6097cc1b34cab2b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-khan-afibanaivuvaavihid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2113c557dc2daa684c6a981ca6d9cecc8876915633c7c9214e43321041506489 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobaic-goib-gvafugauafagi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 599351f460b11b58d9dfa02c0b3dd1abebc885a5031993ef3530de89aee35662 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mitoko-ontcami-lai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82576c1427c98cef2ce838aa805389779b5ca02d093722535d4134a6f54f5e6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-gnyagibhghygdfbdyyui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd7365c375f9f0f739f25d47e5a5d4e4e6e971a5016d82ddae22958cc379c4b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...