EUVD-2025-123727

Malicious code in phoenix-flare-config-altair npm...

EUVD-2025-123720

Malicious code in phoenix-markdown-javascript-sagitta npm...

MAL-2025-145014 Malicious code in mira-phoenix-testcafe-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b95d3d3e4b7723dff42ce077d004d0a8900e90aec20abdf5cf731d1785c3a26c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139278 Malicious code in aldebaran-gatsby-phoenix-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35784680b56a34e605ce149c9cfb50e108268e0841aa302c3aea60dc7460f7dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123009

Malicious code in quantum-promise-phoenix-nodejs npm...

Malicious code in neptune-redis-centaurus-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30cb182b799074deae5eade3e79ff72d686bbd8345adfb98ac22f45c1e1abbe2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Iran-Linked MuddyWater Targets 100+ Organizations in Global Espionage Campaign

The Iranian nation-state group known as MuddyWater has been attributed to a new campaign that has leveraged a compromised email account to distribute a backdoor called Phoenix to various organizations across the Middle East and North Africa MENA region, including over 100 government entities. The...

CVE-2025-41699 Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code 'Code Injection'...

CVE-2025-41707 Phoenix Contact: WebSocket Handler Denial of Service

The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...

CVE-2025-41707 Phoenix Contact: WebSocket Handler Denial of Service

The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...

CVE-2025-41706 Phoenix Contact: Webserver Denial of Service through Malformed Content-Length

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...

CVE-2025-41706 Phoenix Contact: Webserver Denial of Service through Malformed Content-Length

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...

CVE-2025-41705 Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials

An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...

CVE-2025-41704 Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code

An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality...

CVE-2025-41704 Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code

An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality...

CVE-2025-41703 Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command

An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command...

CVE-2025-41703 Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command

An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command...

Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP 访问控制错误漏洞

The Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP is an industrial grade DC uninterruptible power supply module from Phoenix Contact, Germany. An access control error vulnerability exists in the Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP, which originates from an unauthenticated attacker being abl...

Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP 安全漏洞

The Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP is an industrial grade DC uninterruptible power supply module from Phoenix Contact, Germany. A security vulnerability exists in the Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP that originates from an unauthenticated, remote attacker who can obtain...

Phoenix Contact CHARX SEC-3150 代码注入漏洞

The Phoenix Contact CHARX SEC-3150 is an AC charge controller from Phoenix Contact, Germany. The Phoenix Contact CHARX SEC-3150 suffers from a code injection vulnerability that originates from a low-privileged remote attacker who can perform command injection by changing the system configuration...