HAXiam 安全漏洞

HAXiam is a HAX The Web open source This is a wrapper for the HAXcms software. A security vulnerability exists in HAXiam version 11.0.4 and earlier, which stems from an improper response to a user data request and could lead to a user enumeration attack...

RuoYi 安全漏洞

RuoYi is a backend management system by the individual developer of RuoYi in China. A security vulnerability exists in RuoYi 4.8.1 and earlier versions, which stems from an improper restriction of the rendering UI layer of the Image Source Handler component...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers in RuoYi, China. A security vulnerability exists in RuoYi 4.8.1 and earlier versions, which stems from the use of default credentials by the Druid component...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi 4.8.1 and earlier versions, which originates from the incorrect operation of the File parameter File in the function uploadFile in the file...

Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai

Security researchers recently revealed that the personal information of millions of people who applied for jobs at McDonald 's was exposed after they guessed the password "123456" for the fast food chain's account at Paradox.ai , a company that makes artificial intelligence based hiring chatbots...

StudentManage 安全漏洞

StudentManage is a student management system by DayCloud Individual Developer in China. A security vulnerability exists in StudentManage version 1.0, which stems from vulnerability to cross-site request forgery attacks...

StudentManage 安全漏洞

StudentManage is a student management system by DayCloud Individual Developer in China. A security vulnerability exists in StudentManage version 1.0, which stems from improper handling of the component /admin/adminStudentUrl, which could lead to an SQL injection attack...

StudentManage 安全漏洞

StudentManage is a student management system by DayCloud Individual Developer in China. A security vulnerability exists in StudentManage version 1.0, which stems from the mishandling of the Add A New Teacher module and could lead to a cross-site scripting attack...

WordPress plugin Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

MAL-2025-5996 Malicious code in @jssrv/template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce87403bb05aae59ca8877b014a3a8255b54b2a22e930687649c675cc9602f76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TECNO tech.palm.id 安全漏洞

TECNO tech.palm.id is a mobile application from TECNO Corporation in China. A security vulnerability exists in TECNO tech.palm.id, which stems from an authentication flaw that could lead to information disclosure...

The Scratch Channel 安全漏洞

The Scratch Channel is a project website of The Scratch Channel open source. A security vulnerability exists in The Scratch Channel, which stems from a code issue in the api/admin.js file that could lead to a cross-site scripting attack...

The vulnerability of the Windows SmartScreen security function in Microsoft Windows operating systems allows a hacker to circumvent existing security restrictions.

The vulnerability of the Windows SmartScreen security function in Microsoft Windows systems relates to a breach of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to circumvent existing security restrictions...

MAL-2025-5869 Malicious code in @gdcorp-commerce/cx-api-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 968087e3c7d66519a171ae24c3ff7965c24df722ea4b818bde5d1045acaba4ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5867 Malicious code in @ecommerce-cart-ui/client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bac1b682b09340a43e74619f9ac55f2be98bfb14eb37a21597fb9f81b46f4161 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-5394 Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation

The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the aloneimportpackinstallplugin function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers ...

MAL-2025-5893 Malicious code in artifact-registry-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53156ca17e2b337cc206264bd5506b359075734acd01374129803b3eff0732fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5888 Malicious code in ai-audio-descriptions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebf35a4094455afefae874d2367ecf96babc419a5ff8c0474f68beea08f3177b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DOGE Denizen Marko Elez Leaked API Key for xAI

Marko Elez , a 25-year-old employee at Elon Musk's Department of Government Efficiency DOGE, has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security. So it should fill all Americans wi...

MAL-2025-5952 Malicious code in react-redirect-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 438d7e49a15f42d9c8af314bc225c932e4531c3d028d8e602b578777e203300d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...