CVE-2025-12132 WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update

The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due to missing or incorrect nonce validation on the wpclplsave functionality. This makes it possible for unauthenticated attackers to modify...

CVE-2025-12538 Fleet Manager <= 2.5.1 - Authenticated (Editor+) Stored Cross-Site Scripting

The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and abov...

CVE-2025-12632 RandomQuotr <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting

The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2025-12632

CVE-2025-12632 affects the WordPress plugin RandomQuotr. Connected sources confirm a Stored Cross-Site Scripting vulnerability in versions

Malicious code in agus-kupat60-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20989340191a9d9666afc5988620791ac84dcb34784793110ecdb38c733802fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74419 Malicious code in maya-rangi92-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19570e326c5e5cdcff659a889c94f642c385daa741ed6a8deef6bd85ff6417bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70364 Malicious code in respective-silver-skink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c80d2e95f677f8b72e28524775ab983b93b3a9154b143a09c276121be06ad56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70180 Malicious code in rapid-lavender-beetle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d1e1f103a4c659dfc3629a9f84ec397470f31f3ef3dc985c6b1172a2607b350 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68315 Malicious code in fierce-peach-gayal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ec7fe64ff6bb858bbe91f5b35c6e1c9b82883a3e862a67236bbdbc1b8a2415b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66043 Malicious code in wati-buburayam29-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b79818122136e0547242625bdfd282cc6e32363b8e97e68aecc95c56f488bb6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64616 Malicious code in official_hare_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84815e300fad135d47d90f379ce0e6c3822c6c7e27c3fbfa7c9cd747d7438ba6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-63834

A stored cross-site scripting XSS vulnerability was discovered in Tenda AC18 v15.03.05.05multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage...

PT-2025-46281

Name of the Vulnerable Software and Affected Versions RandomQuotr versions prior to 1.0.5 Description The RandomQuotr plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with...

Intel PresentMon 安全漏洞

Intel PresentMon is a tool from Intel Corporation USA. It is used to capture and analyze ETW events related to exchange chain presentations on Windows. A security vulnerability exists in Intel PresentMon versions prior to 2.3.1 that stems from improperly set default permissions, which could lead ...

Malicious Package

Overview grid-settings is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in grid-settings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71b0798fc09c824e110a36baea640ebc023c337f246ab9cc2b6647eb4b9bddad The package grid-settings was found to contain malicious code. Source: ghsa-malware 4461bdacbed2361a56a39a0251d7a47f2454616c944b5380680198ea97f7ef20...

EUVD-2025-50843

Malicious code in grid-settings npm...

MAL-2025-66544 Malicious code in grid-settings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71b0798fc09c824e110a36baea640ebc023c337f246ab9cc2b6647eb4b9bddad The package grid-settings was found to contain malicious code. Source: ghsa-malware 4461bdacbed2361a56a39a0251d7a47f2454616c944b5380680198ea97f7ef20...

EUVD-2025-48944

A stored cross-site scripting XSS vulnerability was discovered in Tenda AC18 v15.03.05.05multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage...

MAL-2025-60158 Malicious code in conscious_salamander_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52bf9a986880b0e84182e97794f72f1799cb308f941c11580b4d13a1b37ee67d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...