Malicious code in react-pdd-select (npm)

The package react-pdd-select was found to contain malicious code...

Malicious code in ui-select-infinity-master (npm)

The package ui-select-infinity-master was found to contain malicious code...

h1-cli-device-browser (>=1.0.1-alpha.0 <=1.0.1-alpha.1), h1-cli-device-node (>=1.0.1-alpha.0 <=1.0.1-alpha.1) potentially affected by unknown CVE via h1-cli-ext-iam-project-select (=1.0.1-alpha.1)

h1-cli-ext-iam-project-select NPM version =1.0.1-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on h1-cli-ext-iam-project-select and may be impacted: - h1-cli-device-browser =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.1 Source cves: unknown CVE...

MAL-2025-19215 Malicious code in edc-ng2-select (npm)

The package edc-ng2-select was found to contain malicious code...

MAL-2025-37598 Malicious code in ui-select-infinity-master (npm)

The package ui-select-infinity-master was found to contain malicious code...

MAL-2025-31845 Malicious code in react-pdd-select (npm)

The package react-pdd-select was found to contain malicious code...

brick-node (>=0.0.0 <=0.0.17), change-object (=0.0.0) +9 more potentially affected by unknown CVE via pause-function (=0.0.1)

pause-function NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pause-function and may be impacted: - brick-node =0.0.0, =1.16.0, =0.0.0, =1.0.1 - stream-format =0.0.3 Source cves: unknown CVE Source advisory: OSV:MAL-2025-28923...

Malicious code in ng2-select-dev (npm)

The package ng2-select-dev was found to contain malicious code...

MAL-2025-19028 Malicious code in dyna-travel-ui-select-air-trip (npm)

The package dyna-travel-ui-select-air-trip was found to contain malicious code...

MAL-2025-27472 Malicious code in ng2-select-dev (npm)

The package ng2-select-dev was found to contain malicious code...

MAL-2025-22079 Malicious code in h1-cli-ext-iam-project-select (npm)

The package h1-cli-ext-iam-project-select was found to contain malicious code...

CVE-2025-8934 1000 Projects Sales Management System sales.php cross site scripting

A vulnerability has been found in 1000 Projects Sales Management System 1.0. Affected is an unknown function of the file /sales.php. The manipulation of the argument select2112 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the publi...

Linux Distros Unpatched Vulnerability : CVE-2020-25815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names f...

Linux Distros Unpatched Vulnerability : CVE-2025-37840

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: rawnand: brcmnand: fix PM resume warning Fixed warning on PM resume as shown below caused due to uninitialized struct nandoperation that checks chip selec...

Django: SQL Injection when using FilteredRelation

A SQL injection vulnerability was discovered in the Django framework when using the FilteredRelation feature. The vulnerability was located in the tests/filteredrelation/tests.py file. The vulnerability allowed an attacker to inject malicious SQL code through the userdata parameter used in the...

Linux Distros Unpatched Vulnerability : CVE-2025-3469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is...

Cross-site Scripting (XSS)

Overview nice-select2 is an A lightweight Vanilla JavaScript plugin that replaces native select elements with customizable dropdowns. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly...

The vulnerability of the Device Admin App operating system ctrlX OS allows a perpetrator to select user account names.

The vulnerability of the Device Admin App on the ctrlX OS involves unlimited distribution of resources. Exploiting this vulnerability allows a malicious actor to select user account names by sending specially crafted HTTP requests remotely...

CVE-2025-5524 OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag

The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above,...

SUSE CVE-2025-38081

In the Linux kernel, the following vulnerability has been resolved: spi-rockchip: Fix register out of bounds access Do not write native chip select stuff for GPIO chip selects. GPIOs can be numbered much higher than native CS. Also, it makes no sense...