mpesa-py (1.0.0), nxviz (0.4.0) +1 more potentially affected by CVE-2025-71176 via pytest (3.6.1)

pytest PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - mpesa-py 1.0.0 - nxviz 0.4.0 - uhb 0.0.3 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

CVE-2026-5645

A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the component Parameter Handler. Executing a manipulation of the argument mpesa can lead to sql injection. The attack can be launched remotely...

CVE-2026-5645

CVE-2026-5645 affects the projectworlds Car Rental System 1.0. The vulnerability is in the Parameter Handler’s file /pay.php , where manipulating the mpesa argument can cause an SQL injection . The attack can be launched remotely, and the exploit has been made publicly available, with exploit mat...

CVE-2026-5645

A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the component Parameter Handler. Executing a manipulation of the argument mpesa can lead to sql injection. The attack can be launched remotely...

PT-2026-30595

Name of the Vulnerable Software and Affected Versions projectworlds Car Rental System version 1.0 Description A weakness exists in projectworlds Car Rental System 1.0. The issue affects an unknown functionality within the /pay.php file of the Parameter Handler component. Manipulation of the mpesa...

CVE-2026-5645: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the component Parameter Handler. Executing a manipulation of the argument mpesa can lead to sql injection. The attack can be launched remotely...

Car Rental System SQL Injection Vulnerability

Car Rental System is a car rental system developed by AMEY THAKUR, an individual developer in India. Version 1.0 of Car Rental System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the mpesa parameter in the pay.php file, which may lead to SQL injection...

mpesa-py (1.0.0), nxviz (0.4.0) +1 more potentially affected by CVE-2025-71176 via pytest (3.6.1)

pytest PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - mpesa-py 1.0.0 - nxviz 0.4.0 - uhb 0.0.3 Source cves: CVE-2025-71176 Source advisory: OSV:GHSA-6W46-J5RX-G56G...

Malicious code in mpesa-backoffice-ekyc-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55257288d3f483f60af585ba393105e594b34c61b2f676965ddb462c5a2ab4e6 The package mpesa-backoffice-ekyc-backend was found to contain malicious code...

EUVD-2025-44065

Malicious code in mpesa-backoffice-ekyc-backend npm...

MAL-2025-55034 Malicious code in mpesa-backoffice-ekyc-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55257288d3f483f60af585ba393105e594b34c61b2f676965ddb462c5a2ab4e6 The package mpesa-backoffice-ekyc-backend was found to contain malicious code...

Malicious Package

Overview mpesa-backoffice-ekyc-frontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malware in mpesa-backoffice-ekyc-frontend

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in mpesa-backoffice-frontend (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-42029 Malicious code in mpesa-backoffice-frontend (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-42028 Malicious code in mpesa-backoffice-ekyc-frontend (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1d40690b03ef978ac9c358228d4e0372e07e448e4e8d894ab44d49e70d23bac Any computer that has this package installed or running should be considered...

Malicious code in mpesa-backoffice-ekyc-frontend (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1d40690b03ef978ac9c358228d4e0372e07e448e4e8d894ab44d49e70d23bac Any computer that has this package installed or running should be considered...

Malicious code in mpesa-ui-components (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6736 Malicious code in mpesa-ui-components (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-7475

A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part of the file /pay.php. The manipulation of the argument mpesa leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to...