Malicious code in natel-plotly-panel (npm)

The package contains suspicious preinstall, preupdate, and test scripts in pakage.json that download and execute code from a remote server oastify.com. This allows for arbitrary code execution and exfiltration of sensitive information username, path, hostname during installation, update, and...

PT-2025-27334 · Code Projects · Code-Projects Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management System version 1.0 Description: A critical vulnerability was found in the code-projects Inventory Management System. This issue affects unknown code of the file /php action/editPayment.php. The manipulation ...

CVE-2025-49152

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

CVE-2025-52717

CVE-2025-52717 corresponds to an SQL Injection in the WordPress plugin LifterLMS (versions n/a through 8.0.6). Multiple sources confirm a server-side SQL injection vulnerability due to improper neutralization of SQL commands in LifterLMS, affecting the WP LMS for eLearning, Online Courses, and Qu...

WordPress Code Engine plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Code Engine plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied...

WordPress Zoomsounds plugin file upload vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file upload vulnerability exists in the WordPress Zoomsounds plugin that originates from allowing unauthenticated users to upload arbitrary files to a web server. No details o...

PT-2025-27077 · Woocommerce · Gg Bought Together For Woocommerce

Name of the Vulnerable Software and Affected Versions: wpopal GG Bought Together for WooCommerce versions 1.0.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-27250 · Unknown · Tabberneue

Name of the Vulnerable Software and Affected Versions: TabberNeue versions 3.0.0 through 3.1.0 Description: The issue allows any user to insert arbitrary HTML into the DOM by inserting a payload into any allowed attribute of the tag, posing a significant security risk to user data. Recommendation...

PT-2025-27265 · Marvell · Marvell Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: The issue is related to a directory traversal information disclosure vulnerability in the getFileUploadBytes function. This allows for potential information disclosure. The...

PT-2025-27123 · Unknown · Thembay Diza

Name of the Vulnerable Software and Affected Versions: thembay Diza versions 1.3.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This ...

PT-2025-27041 · Flock Safety · Flock Safety Lpr

Name of the Vulnerable Software and Affected Versions: Flock Safety LPR devices with firmware through 2.2 Description: The issue concerns a hardcoded password for a system in Flock Safety LPR devices. Recommendations: For Flock Safety LPR devices with firmware through 2.2, consider changing the...

PT-2025-27047 · Unknown · Huija Bicyclesharingserver

Name of the Vulnerable Software and Affected Versions: huija bicycleSharingServer version 1.0 Description: A critical issue affects the selectAdminByNameLike function of the AdminController.java file, leading to SQL injection. The attack may be initiated remotely. The exploit has been disclosed t...

PT-2025-27509 · Node Red · Node-Red

Name of the Vulnerable Software and Affected Versions: Node RED affected versions not specified Description: An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node RED server is not configured by default...

CVE-2025-6735 juzaweb CMS Import Page imports improper authorization

A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Import Page. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to...

CVE-2025-52900

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the...

CVE-2025-6624

Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or...

OneTrust SDK 6.33.0 - Denial Of Service (DoS)

Exploit Title: OneTrust SDK 6.33.0 - Denial Of Service DoS - Date: 01/01/2025 - Exploit Author: Alameen Karim Merali - Vendor Homepage: OneTrust JavaScript API - Software Link: otBannerSdk.js v6.33.0 - Version: 6.33.0 - Tested on: Kali Linux - CVE ID: CVE-2024-57708 Vulnerability Summary A...

MAL-2025-5359 Malicious code in alicn (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c44180101b7fa8e907bac795a460f192261063ce1d1bb3522f7a7b5db03cea8 Any computer that has this package installed or running should be considered...

Malicious code in collab-app (npm)

The package communicates with a domain associated with malicious activity...

CVE-2021-4457

CVE-2021-4457 concerns the ZoomSounds WordPress plugin prior to 6.05, where a vulnerable PHP file allows unauthenticated users to upload arbitrary files anywhere on the web server. This leads to a high-impact exposure (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; base 9.1) affecting the plugin’...