PT-2025-46818

Name of the Vulnerable Software and Affected Versions Envira Photo Gallery versions up to and including 1.12.0 Description The Envira Photo Gallery plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check in several functions. Authenticated...

PT-2025-46793

Name of the Vulnerable Software and Affected Versions Convert WebP & AVIF | Quicq versions prior to 2.0.1 Description The Convert WebP & AVIF | Quicq WordPress plugin is susceptible to unauthorized data modification. This is due to a missing capability check on the wp ajax wpqai disconnect quicq...

WordPress plugin quicq 安全漏洞

WordPress quicq plugin is an image optimization tool designed for WordPress that automatically compresses and resizes images to improve website performance. A missing capability check vulnerability exists in WordPress quicq plugin, which can be exploited by attackers to cause unauthorized data...

WordPress plugin Survey Maker 安全漏洞

WordPress Survey Maker plugin is a tool for creating questionnaires with support for multiple question types and data analysis features for businesses or individuals to collect user feedback. WordPress Survey Maker plugin suffers from a missing capability check vulnerability, which stems from a...

HP Integrated Lights-Out Improper Input Validation (CVE-2022-28633)

A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file...

HP Integrated Lights-Out Improper Input Validation (CVE-2016-4375)

Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 aka iLO 3 firmware before 1.88, Integrated Lights-Out 4 aka iLO 4 firmware before 2.44, and Integrated Lights-Out 4 aka iLO 4 mRCA firmware before 2.32 allow remote attackers to obtain sensitive information, modify data, or cause...

Malicious code in avangi-ogolia-iualim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c0fea4fd78dd3b54e429d00ad10b0d377e2c6ee3b6c934b6097cc1b34cab2b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-khan-afibanaivuvaavihid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2113c557dc2daa684c6a981ca6d9cecc8876915633c7c9214e43321041506489 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobaic-goib-gvafugauafagi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 599351f460b11b58d9dfa02c0b3dd1abebc885a5031993ef3530de89aee35662 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mitoko-ontcami-lai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82576c1427c98cef2ce838aa805389779b5ca02d093722535d4134a6f54f5e6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-gnyagibhghygdfbdyyui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd7365c375f9f0f739f25d47e5a5d4e4e6e971a5016d82ddae22958cc379c4b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kaos-fgahgfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2655f7ee67cc735b4e907ddf0c103746c219f5cc83449838e38f1de79ad6bf2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avangi-ogolia- (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26689f38edce438ae7b18ed3f3841510cd5c01422b7825f5ac519d3acbffccb0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-ggmatondanggangtengdydjdyru (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8d359b148483d013f6c4f56bc3dc2c014b7a87ed05c63278c978222b164cba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonec-kat-fav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93bf3cba881be9893eb70ec324f44e42369afb3ce827e94377dd1c56f9891314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imugay-avig-if (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5692a93f7c8727c0f72cee1e3ca9c2a9c03af8c1ab0c173636c0ff6dfd2e300 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manu-oib-gis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ddc6c65dee1b85a3729add344226cb2ddad682833ec29d7b4c092844ef57bde This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in libc-ubg-atafug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb3b6372948239554de27760b542f9f840b316ee98d71aeb5a5d9b8d8ef5c85d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-dci-rrsetrtt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7615dedf69d9a115af6fb44942578d04c144f7f908787477a2de52aefbcccea6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kian-avumangaffgaiab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55eabf97fdd3aac34f4386a4aa6fab4454e8f2c305a9be82c3a3702e5a464936 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...