225566 matches found
Malicious Package
Overview lazyhtml-scripts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2025-210927
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...
CVE-2026-92949: Modification of Assumed-Immutable Data (MAID)
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze and vm.readonly protections. Attackers can use Object.getOwnPropertyDescriptor or lookupSetter to extract and invoke host object setters...
PT-2026-94261
Name of the Vulnerable Software and Affected Versions Element Pack Elementor Addons versions prior to 8.8.4 Description Cross Site Scripting XSS allows an attacker with contributor-level permissions to execute malicious scripts in the browser of other users. Recommendations Update Element Pack...
PT-2026-95179
Name of the Vulnerable Software and Affected Versions Brizy – Page Builder versions prior to 2.8.15 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web...
CVE-2026-88792: Improper Neutralization of Input During Web Page Generation
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...
Malicious code in @traktis/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...
MAL-2026-16222 Malicious code in @traktis/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...
Malicious code in @traktis/environment (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9bdabc95f4e8bc70e348557c1cae7d2447d9bd1405ac7a23945ded47ec04a8 package.json declares preinstall and postinstall lifecycle scripts that invoke curl against the hardcoded cleartext endpoint...
MAL-2026-16223 Malicious code in @traktis/environment (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9bdabc95f4e8bc70e348557c1cae7d2447d9bd1405ac7a23945ded47ec04a8 package.json declares preinstall and postinstall lifecycle scripts that invoke curl against the hardcoded cleartext endpoint...
CVE-2026-92129
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...
Malicious code in tetomood (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92 package.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory $pwd and machine...
MAL-2026-16216 Malicious code in tetomood (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92 package.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory $pwd and machine...
Malicious code in tetotest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6 package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory $pwd and...
MAL-2026-16217 Malicious code in tetotest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6 package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory $pwd and...
CVE-2026-92129: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...
PT-2026-93765
Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1415.v9a f9b 3a c253d and earlier Description An issue exists where the plugin fails to verify the method called through a proxy created when a sandboxed script coerces a value to an interface. If the...
PT-2026-93769
Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Users with permission to define and run sandboxed scripts, such as Pipelines, can execute code outside the sandbox. This occurs because the plugin fails to reje...
PT-2026-93872
Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...
CVE-2026-84397: Improper Neutralization of Input During Web Page Generation
Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...