CVE-2025-9052

Summary: CVE-2025-9052 affects projectworlds Travel Management System 1.0. A vulnerability exists in the /updatepackage.php file where manipulating the s1 parameter enables SQL injection. The issue is exploitable remotely, and public exploitation information is available. Multiple connected sourc...

Malicious code in file-alb-um-zip-new-mp3-65426-satyagraha-1-lpo1l-rqohyk (npm)

The package file-alb-um-zip-new-mp3-65426-satyagraha-1-lpo1l-rqohyk was found to contain malicious code...

Malicious code in @zalastax/nolb-lion-lib-t (npm)

The package @zalastax/nolb-lion-lib-t was found to contain malicious code...

MAL-2025-20543 Malicious code in file-alb-um-zip-new-mp3-none-shall-pass-9w6ra-hddlmn (npm)

The package file-alb-um-zip-new-mp3-none-shall-pass-9w6ra-hddlmn was found to contain malicious code...

MAL-2025-20532 Malicious code in file-alb-um-zip-new-mp3-200499-threads-i0tvt-cdrrmq (npm)

The package file-alb-um-zip-new-mp3-200499-threads-i0tvt-cdrrmq was found to contain malicious code...

GZDoom 安全漏洞

GZDoom is a ZDoom open source feature-centric port of all Doom engine games based on ZDoom. A security vulnerability exists in GZDoom version v4.13.1 that stems from improper parsing of malicious PK3 files by ZScript functions. An attacker exploiting this vulnerability could execute arbitrary cod...

MAL-2025-688 Malicious code in test_package_file (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53b443550dc59ee48bf343b26a7e563407dc65e43fc2fd49c177854a1ecb70eb Any computer that has this package installed or running should be considered...

PT-2024-17820 · Code Projects · Code-Projects Travel Management System

Name of the Vulnerable Software and Affected Versions: code-projects Travel Management System version 1.0 Description: A critical issue has been found in the code-projects Travel Management System, affecting unknown code in the /package.php file. The manipulation of the subcatid argument leads to...

CVE-2022-48554 affecting package file for versions less than 5.40-3

CVE-2022-48554 affecting package file for versions less than 5.40-3. A patched version of the package is available...

PT-2024-38493 · Sourcecodester · Sourcecodester Car Driving School Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Car Driving School Management System version 1.0 Description: A critical issue was found in the SourceCodester Car Driving School Management System, affecting an unknown functionality of the file manage package.php. The...

CVE-2024-23347

Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application...

CVE-2023-51449 Make the `/file` secure against file traversal attacks

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...

CoreCode MacUpdater Code Issue Vulnerability

CoreCode MacUpdater is a program from CoreCode that scans your Mac and shows you which of your installed applications are not up-to-date. A security vulnerability exists in CoreCode MacUpdater versions prior to 2.3.8 and versions 3.x through 3.1.2. An attacker exploited the vulnerability to eleva...

SUSE CVE-2011-1072

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories, a different vulnerability than CVE-2007-2519...

Path traversal

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 allows an unauthenticated attacker to create, tamper with or destroy arbitrary files by getting a legitimate user import a project package...

PT-2022-25309 · Mitsubishi · Genesis64

Name of the Vulnerable Software and Affected Versions: ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 Description: The issue allows an unauthenticated attacker to create, tamper with, or destroy arbitrary files by getting a legitimate user to import a project package file crafted...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution via the extract and files methods of the RPM::File. Exploiting this vulnerability is possible when using RPM::Filefiles and RPM::Fileextract methods with a malicious payload compressor field in the RPM...

CVE-2021-27783

User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed...

Code injection

Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package file obtained from an unauthorized source or a file that was compromised between download and deployment...

CVE-2022-26516 ICSA-22-104-03 Red Lion DA50N

Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package file obtained from an unauthorized source or a file that was compromised between download and deployment...