814 matches found
MAL-2025-16115 Malicious code in bravo-orange-lvmt (npm)
The package bravo-orange-lvmt was found to contain malicious code...
MAL-2025-28444 Malicious code in orange-yp2-project (npm)
The package orange-yp2-project was found to contain malicious code...
MAL-2025-14703 Malicious code in apple-orange-banana-kpynd (npm)
The package apple-orange-banana-kpynd was found to contain malicious code...
CVE-2023-50429
IzyBat Orange casiers before 202308031 allows getEnsemble.php ensemble SQL injection...
CVE-2023-22630
IzyBat Orange casiers before 202211021 allows SQL Injection via a getCasier.php?taille= URI...
CVE-2022-36161
Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter...
CVE-2021-24688
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing...
CVE-2021-24704
In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...
CVE-2018-14474
views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup...
CVE-2018-18376
goform/getWlanClientInfo in Orange AirBox Y858FL01.1604 allows remote attackers to discover information about currently connected devices hostnames, IP addresses, MAC addresses, and connection time via the rand parameter...
📄 Craft CMS Image Transform Pre-Authenticaton Remote Code Execution
This Metasploit module exploits an unauthenticated remote code execution vulnerability in Craft CMS versions 3.x, 4.x, and 5.x prior to 5.6.17 via the image transform endpoint. It injects a PHP Meterpreter payload into the Craft session, then triggers its execution by abusing the Yii behavior...
Malicious code in orange-meets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37037d337633f63999cc9026f347d4542faaf8a86bc78184e98a7031c17cfbe3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1371 Malicious code in orange-meets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37037d337633f63999cc9026f347d4542faaf8a86bc78184e98a7031c17cfbe3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-775 Malicious code in @orange-team/map-rank-tracker-frontend (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9891 Malicious code in uncertain-orange-snake (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in uncertain-orange-snake (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in semantic-orange-shrew (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9836 Malicious code in semantic-orange-shrew (npm)
--- -= Per source details. Do not edit below this line.=-...