CVE-2025-12827: Cross-Site Request Forgery (CSRF)

The Top Friends plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing nonce validation on the topfriendsoptionssubpanel function. This makes it possible for unauthenticated attackers to modify plugin settings via a forge...

CVE-2025-12524: Authorization Bypass Through User-Controlled Key

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type...

PT-2025-47394

Name of the Vulnerable Software and Affected Versions Eurolab ELTS100 UBX version ELTS100v1.UBX Description The Eurolab ELTS100 UBX device is subject to Broken Access Control because of a lack of authentication on critical administrative endpoints. Attackers can directly access and modify sensiti...

CVE-2025-36357

IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system...

SAP NetWeaver Privilege Bypass

The vulnerability of the SAP NetWeaver software integration platform is related to errors in privilege management. Exploiting this vulnerability can allow an attacker, operating remotely, to gain read, modify, or delete access to confidential data...

Synology Contacts for DSM Cross-site Scripting Vulnerability

Synology Contacts for DSM is a contact server provided by the Chinese company Synology. There is a security vulnerability in Synology Contacts for DSM, which allows attackers to bypass access restrictions and read or modify files...

Malicious code in cat-sudo-node-decrypt-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d0a5654a946e29c85296ee9ea01233be92fe24df0af60de4d8e5e56deb22634 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-dependencies-cybernetics-cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 394b529057f391623b292a4b60d7a51f780d22380dc2cdc5a4c2595970c8ba9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-eigenstate-eris-mineralogy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77108ac43c4067f2b2b30395cd971409d60596526481a9d008575809b6265deb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fusion-farout-centaurus-metabolomics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2140688c53dbf3ddf8362b2fcb5efa17784ba7b517e493646a526609e0bff85e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolve-code-sun-sanitize-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abdbdcc8fb619c74fdb9b14089fa86dadcd27a20aad53d18bd359bd1f2d0664b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-pegasus-version-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07184acbaeb5b745eda222d46eac28e2940e487c1388e93807d25bcb67d72286 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-html-webpack-plugin-hologram-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a9afe8f4ab2829ba5b5196f1795f383340927d445f5df8c4dafeb0d41be9b8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perturbation-nextjs-singularity-gravitationalwave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b165730c41881b44c233e780d2b9bde16b2fa49b0f012d8c28a06092c15347d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loop-webdriverio-vulcan-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3f9d3f3f64e3dcfb01546c14df5e1d0e289308f7238bf5fb36f487b9e92423e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-astrobiology-magellan-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2c2f4a1059031e0a45ea178d7af7eb11800fc2c6f6b0f385b866faf57316f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in juno-saturnology-sass-loader-joviology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beb54e9749d9d21998cf67910838ec70d40b9d045cee981abefd69fed26a290d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in run-script-australis-quito-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42f23afb76dd834950908db36270f132db3d2309a7d62c3f676096e347dfccdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-areology-glaciology-charon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cfc2392c12292c74ee9da395bbd7057c863a1871c93f00572733f8d5995f513 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in native-blackhole-parcel-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a471cc517289478a545c2d4f578f4a0270138b69edff1c911bc1f622c60c9c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...