MAL-2025-63822 Malicious code in kiki-rangi94-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74d01be446ea5eb21ac1a7241e80495fd35eddb1ec07f55d3163e4f5ed42ff3a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61328 Malicious code in special_haddock_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba3f8fefeaf99585765c0a329b5fd961784851a6bbacbc72d8a728820b266da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61161 Malicious code in related_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b3537e6787790d0253a157521910deba3161f6aa1590774ba0f04cb0b4b188 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umi-bubursumsum25-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecf883af95195fd621be272b4318449654d8d60b142334fddcdaed4222def4e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umi-sego50-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1fbda22f2006e9ab7138c0aef27d07e10b29557fa874b1787cf3c4c8c9b1246 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58148 Malicious code in peculiar_quail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d2bd83c027a07258c652cd28a318bda61bbd9cdcceaa23aab518c5ffbeca1da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-59280 Malicious code in vida-gaplek46-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b28bde7a0bfc833e082ca142a274478dd93647ae1e19eefc5a50b5d1ec35ddf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54886 Malicious code in sinta-teh78-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cedfc45a904695da08ac753ae9703f82cda61bf2a78a1b0e5757ac4138353a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-50286 Malicious code in eka-saguer38-devapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95ea251505ca63b8b5e1b6a99adb32eac15ace6e20195b5e70e2aa3beeca029b The package eka-saguer38-devapp was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

PT-2025-45596

Name of the Vulnerable Software and Affected Versions SourceCodester Survey Application System version 1.0 Description A flaw exists in the SourceCodester Survey Application System that allows for SQL injection. This occurs through manipulation of the fullname argument within the save user/update...

PT-2025-45582

Name of the Vulnerable Software and Affected Versions qianfox FoxCMS versions up to 1.2.16 Description A cross-site scripting issue exists in the add/edit function of the app/admin/controller/Product.php file. Manipulation of the Title argument can trigger this issue. The attack can be initiated...

CVE-2025-12913 code-projects Responsive Hotel Site roomdel.php sql injection

A flaw has been found in code-projects Responsive Hotel Site 1.0. This affects an unknown part of the file /admin/roomdel.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used...

CVE-2025-11758

The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wpajaxnopriv hooks, while relying onl...

CVE-2025-12617

A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/logincrud.php. Executing a manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be use...

CVE-2025-12617

A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/logincrud.php. Executing a manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be use...

CVE-2025-12617

A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/logincrud.php. Executing a manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be use...

EUVD-2025-37471

A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/logincrud.php. Executing manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used...

CVE-2025-12598

A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function savetenant of the file /adminclass.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be launched remotely. The exploit has been...

CVE-2025-12598

A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function savetenant of the file /adminclass.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be launched remotely. The exploit has been...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the openEditor function when the EDITOR environment variable and configuration file path that are passed unsanitized to a shell command. An attacker can execute arbitrary system commands by manipulating the EDITOR...