13073 matches found
MAL-2025-5994 Malicious code in acsascasccsaascascacs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a4d29e3ba25b084215e80ac7601a998e66cf11ad88607db37e23fa50817b135 The OpenSSF Package Analysis project identified 'acsascasccsaascascacs' @ 1.0.2 npm as malicious. It is considered malicious because: - The...
MAL-2025-6108 Malicious code in node-ts-esm-auto (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...
WordPress Transposh WordPress Translation plugin <= 1.0.7 - Reflected Cross-Site Scripting via tp_tp vulnerability
Reflected Cross-Site Scripting via tptp vulnerability discovered by Julien Ahrens in WordPress Plugin Transposh WordPress Translation versions = 1.0.7...
CGA-4V65-X4VV-C7RJ
Bulletin has no description...
CGA-FF3X-MC4G-82Q2
Bulletin has no description...
CGA-MP4Q-MRJJ-8862
Bulletin has no description...
MAL-2025-6549 Malicious code in memtools (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 fafb3bba871c43e80681f3c9f4618ec7547fe2295b120eb93adf31a59bf021f3 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...
MINI-P34H-Q964-R74V
Bulletin has no description...
MAL-2025-6547 Malicious code in memlib (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a0d0e362d3ea9b768078a9e47f80c667acef799c7099f8044e74fd1738fdedb4 Installing the package triggers a code that looks like downloading a picture, but in fact downloads and starts an executable with malware. Note that file...
CVE-2025-53934 WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'control.php' parameter 'descricao_emergencia'
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the control.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...
CGA-HJ53-W7GR-6F9R
Bulletin has no description...
CGA-22W7-73F6-8684
Bulletin has no description...
MAL-2025-6074 Malicious code in blocknote-editor (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...
CVE-2025-40923 Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely
Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if i...
WordPress YayExtra plugin <= 1.5.5 - SQL Injection Vulnerability
SQL Injection Vulnerability discovered by Lê Quốc Bảo in WordPress Plugin YayExtra versions = 1.5.5...
WordPress LightBox Block plugin <= 1.1.30 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Prissy in WordPress Plugin LightBox Block versions = 1.1.30...
WordPress WooCommerce Google Sheet Connector plugin <= 1.3.20 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WooCommerce Google Sheet Connector versions = 1.3.20...
WordPress Multimedia Playlist Slider Addon for WPBakery Page Builder <= 2.1 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Multimedia Playlist Slider Addon for WPBakery Page Builder versions = 2.1...
CVE-2025-24759 WordPress WP-BusinessDirectory <= 3.1.5 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Blind SQL Injection.This issue affects WP-BusinessDirectory: from n/a through = 3.1.4...
