PT-2025-1810 · Icegram Express · Email Subscribers

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express versions prior to 5.7.44 Description: The issue concerns a SQL injection vulnerability. It occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement, allowing...

NiceGUI 授权问题漏洞

NiceGUI is an easy-to-use, Python-based UI framework open-sourced by NiceGUI. An authorization issue vulnerability exists in NiceGUI versions prior to 2.9.1, which stems from the fact that authentication using NiceGUI can allow a user to log in on all browsers, including those in incognito mode...

Malicious code in eslint-config-proton-lint (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d595489e0b5943870a58ffcd154d1a8ab7b4bbd45155465dbe9272bb6471060 Any computer that has this package install...

Malicious code in express-v4 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67ebd6ae141b2ad735a5d06a361820acbdba7b725729e8fa795cf1be86282e30 Any computer that has this package install...

Malicious code in old-mpl-token-metadata (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6603cd004d4fbdaf7a066de7f7057ad66c4108e0bd8d961201d12f326fc1d7bf Any computer that has this package install...

Malicious code in appboy-web-sdk-v2 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0c15da90dc72a0bf53f2dccb6e0419535a29d50e59fb3de4b5fb7a2f72245ea Any computer that has this package install...

Malicious code in @g.genie/api-demo-sample-lib4 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain...

MAL-2025-57 Malicious code in api-demo-sample-lib3 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=-...

Malicious code in api-demo-sample-lib3 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=-...

Malicious code in player-workshop (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2f2abed0d43ff0cb4723fad6e2c44fe25c5a9923cc44294ec1b199b4479d298 Any computer that has this package install...

Malicious code in issue-label-notification-action (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff65d59f127c562cf9ea1320a2eacb30540db8dff0ec2237c43f42add231b143 Any computer that has this package install...

Malicious code in lambda-demo (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70fa7a653e95d7b948968c1605f557ae4f569e78a26d160f8768a44bca1b6f5b Any computer that has this package install...

MAL-2025-53 Malicious code in muzeeglot (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a924cd903cd9ec3511c788b9d1b75874ed09f4786dcf83a141a6424a9dddfd86 Any computer that has this package install...

Malicious code in muzeeglot (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a924cd903cd9ec3511c788b9d1b75874ed09f4786dcf83a141a6424a9dddfd86 Any computer that has this package install...

Malicious code in facetec-browser-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38f356209be66b9759fe0891f0751be720e7d758d002e5fd1541f0c10619f45c Any computer that has this package install...

Malicious code in zqdl555 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b18d98c2639c2052e5fcb38fd21e609aef6201aa3e78bda2cb13f15227c08a5e Any computer that has this package install...

Malicious code in zqdl111 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad799637c930c5cdd91adee64300966d8a04c8ad1af244ca59d2e0049b86dc3e Any computer that has this package install...

Malicious code in zqdl333 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f6366a5f4a87b1ca15c8a0edbf77942b242f6a055cce26d3ad4e91ad92e7ae3 Any computer that has this package install...

MAL-2025-15 Malicious code in zqdl333 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f6366a5f4a87b1ca15c8a0edbf77942b242f6a055cce26d3ad4e91ad92e7ae3 Any computer that has this package install...

libreswan: Missing PreSharedKey for connection can cause crash

A flaw was found in Libreswan. This issue causes Libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys authby=secret, and the connection cannot find a matching configured secret. When automatically added on startup using the auto= keyword,...