WordPress plugin Asgaros Forum 跨站请求伪造漏洞

WordPress Asgaros Forum plugin is a lightweight forum plugin designed for WordPress that supports the rapid creation and management of forum pages, providing basic posting, replying, user management and other functions. The WordPress Asgaros Forum plugin suffers from a cross-site request forgery...

PT-2025-46767

Name of the Vulnerable Software and Affected Versions code-projects Responsive Hotel Site version 1.0 Description A SQL injection issue exists in code-projects Responsive Hotel Site 1.0. The issue is located in the file /admin/usersettingdel.php. Manipulation of the eid argument can lead to SQL...

PT-2025-46770

Name of the Vulnerable Software and Affected Versions code-projects Responsive Hotel Site version 1.0 Description A SQL injection flaw exists due to manipulation of the usname argument within an unknown function of the /admin/usersetting.php file. This issue can be exploited remotely. The exploit...

MAL-2025-135249 Malicious code in lisa-rujak10-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ed1bd442df0fbdd576609840c711f383b512026f440411fad031f9d9f9a464a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-135325 Malicious code in lutfi-sambalado82-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f88704779b82a5fd0943f56457fc424f6f8f176ecf956e84622aa285947c4828 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fitri-lodeh64-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e3d9f79ab3946e2d8aa33a6fd4f1760e861328b4dd2ab8333d69f57af8ade05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sufficient_warbler_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13b3fa47efeb109fc70559c25fce9ca3cc79de973dfa336987f16dc05f9d5059 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-telurtahu20-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 344a9d1a54c0e5522b4475627258c638925122022dea1ab579b0315d0bbc6e3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-126142 Malicious code in electric_dinosaur_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fbdbc491d316e467c22677306dc4b21a471af8ff57766ae6e3fb12694199e6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bambang-moci41-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4462a30233e31086381a611a64ca6d29271553bc082ecd448817f18c8ef19edc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123134 Malicious code in sari-semur8-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47fb8557e98e7f81adf289d84b9d62f4521ebb0101460713fcd1e9b859a71649 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-ikan73-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8176206097e6e204960346c1ecb2ed781d68c8b5f997eae9cc6cc0a9f5231cc4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-84363

The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials hostname, username, and API key in files within the web-accessible wp-content directory witho...

Malicious code in nutritious_bobcat_ivory-19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fdf02c34fc1f8636ec7bcd51b21ed0cacd105b294eb92ec6c0c546bc0aeaa55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eligible_antelope_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc98f9e00035391856e2a75b2f32f9b42c14f3132e4b19ed11bd5effeb593f6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in clumsy_junglefowl_replicate_automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47d9b22e35c3e5a6f4925e8b4334c0c7377e7c5f219c46d16ada88177d83b78b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-60938

The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

EUVD-2025-60954

The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due to missing or incorrect nonce validation on the wpclplsave functionality. This makes it possible for unauthenticated attackers to modify...

MAL-2025-97288 Malicious code in voiceless_anteater_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e75c172b46b5bafd38507205cc832fa01576714309e541b8d251021814043cfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-94877 Malicious code in huge_mite_requirement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4ad9acd38a2f4f484903af23b7b5e96e85c0bb9e186c97d44b48e36c9762f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...