CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

EUVD-2026-90209

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224

The MineAdmin backend management system is vulnerable to a path traversal flaw in its app-store plugin service prior to version 3.2.0-alpha.2 . The application fails to sanitize the user-supplied identifier parameter, concatenating it directly into filesystem paths within plugin/mine-admin/app-st...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224: Improper Limitation of a Pathname to a Restricted Directory

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

Malicious Package

Overview capacitor-plugin-service-worker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malware in capacitor-plugin-service-worker

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in capacitor-plugin-service-worker (npm)

Source: amazon-inspector 36f1958d8bc44724a00d45b291983ad836dc2f28370c27f83c76f7bf1780bd4b The package capacitor-plugin-service-worker was found to contain malicious code. Source: ossf-package-analysis 3f28ba8fd7638915ed1060990ac5bbe779c131ee7453a155248a2f5d9d8c8e53 The OpenSSF Package Analysis...

GHSA-59XM-4M8C-G3XJ MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall Summary The app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences e.g., ../ to read, install, or uninstall plugins from...

PT-2026-80225

Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall Summary The app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences e.g., ../ to read, install, or uninstall plugins from...

PT-2026-80765

Name of the Vulnerable Software and Affected Versions MineAdmin versions prior to 3.2.0-alpha.2 Description The app-store plugin service fails to sanitize the identifier variable before concatenating it into file system paths. This allows an attacker to use path traversal sequences, such as ../, ...

kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)

starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: OSV:PYSEC-2026-1552...

3lc (>=2.3.84, <=2.6.4), aiocronjob (>=0.6.0, <=0.7.0) +10 more potentially affected by CVE-2024-52581 via starlite (>=1.39.0, <=1.51.16)

starlite PYPI version =1.39.0, =2.3.84, =0.6.0, =0.4.0, =0.5.0, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.1.0, =0.8.1 - strawberry-graphql 0.168.0 Source cves: CVE-2024-52581 Source advisory: OSV:PYSEC-2026-1944...

MSC-2026-5162

The npm package capacitor-plugin-service-worker versions 100.0.0 through 100.2.0 contain malicious code that executes automatically upon installation via a preinstall script. The malicious code collects sensitive system and network information — including hostname, IPv4 addresses with MAC...

CVE-2026-28427

CVE-2026-28427 affects OpenDeck (Linux software for the Elgato Stream Deck). Prior to version 2.8.1, the service listening on port 57118 serves static plugin files but does not sanitize path components properly. An attacker can use ../ sequences in the request path to traverse outside the intende...

3lc (>=2.3.84, <=2.6.4), aiocronjob (>=0.6.0, <=0.7.0) +10 more potentially affected by CVE-2024-52581 via starlite (>=1.39.0, <=1.51.16)

starlite PYPI version =1.39.0, =2.3.84, =0.6.0, =0.4.0, =0.5.0, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.1.0, =0.8.1 - strawberry-graphql 0.168.0 Source cves: CVE-2024-52581 Source advisory: GHSA-GJCC-JVGW-WVWJ...

kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)

starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: MEND:CVE-2024-32982...

kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)

starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: GHSA-83PV-QR33-2VCF...

kiara-plugin-service (>=0.4.0, <=0.4.7), playbacker (>=0.5.0, <=0.7.1) potentially affected by CVE-2024-32982 via starlite (>=1.39.0, <=1.51.10)

starlite PYPI version =1.39.0, =0.4.0, =0.5.0, =0.7.1 Source cves: CVE-2024-32982 Source advisory: OSV:GHSA-83PV-QR33-2VCF...