EUVD-2023-48198

Malicious code in bioql PyPI...

EUVD-2023-40914

Malicious code in bioql PyPI...

EUVD-2022-38980

Malicious code in bioql PyPI...

EUVD-2025-19905

Malicious code in bioql PyPI...

EUVD-2022-3491

Malicious code in bioql PyPI...

EUVD-2024-32148

Malicious code in bioql PyPI...

EUVD-2024-54191

Malicious code in bioql PyPI...

EUVD-2024-44264

Malicious code in bioql PyPI...

EUVD-2025-12493

Malicious code in bioql PyPI...

EUVD-2025-4530

Malicious code in bioql PyPI...

EUVD-2022-49618

Malicious code in bioql PyPI...

EUVD-2024-53886

Malicious code in bioql PyPI...

EUVD-2024-52777

Malicious code in bioql PyPI...

EUVD-2023-50981

Malicious code in bioql PyPI...

EUVD-2021-28448

Malicious code in bioql PyPI...

EUVD-2022-3409

Malicious code in bioql PyPI...

CVE-2025-8417 Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection

The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token e.g. ?key= 900001705 without proper authentication, combined with the unsafe use of eval on...

CVE-2014-125116

A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script remains accessible after deployment and fails to sanitize input before writing to the application’s config.php file. An unauthenticated...

CVE-2015-10141 Xdebug Remote Debugger Unauthenticated OS Command Execution

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker ca...

Remote Code Execution (RCE)

bolt/bolt is vulnerable to remote code execution RCE. The vulnerability is due to unsanitized rendering of user-controlled input PHP code injection in the displayname field in backend templates, followed by abuse of session file manipulation endpoints which allows an attacker to create a web shel...