CVE-2025-15414 go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414 go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

PT-2026-1030

Name of the Vulnerable Software and Affected Versions go-sonic versions up to 1.1.4 Description A server-side request forgery issue exists in the Theme Fetching API of go-sonic. The flaw is located in the FetchTheme function within the service/theme/git fetcher.go file. Manipulation of the uri...

Sonic 代码问题漏洞

Sonic is a go-sonic open source high performance blogging system developed using golang. A code issue vulnerability exists in Sonic 1.1.4 and earlier versions, which stems from the incorrect operation of the parameter uri in the FetchTheme function in the Theme Fetching API component file...

Microsoft Azure 安全漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A security vulnerability exists in Microsoft Azure that stems from a stack-based buffer overflow in the Software for Open Networking in the Cloud SONiC allowing an unauthorized attacker ...

Malicious code in sonic-ks-fudiaja (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f765b984dfe3c6ef52816e23955230a2831402a1ad915d173b1df690ca3d983 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-ijos-aaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cf74211cd544e2a039a5c5ed42be2ad10226c5357d47d6e8093347d686e1624 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kuig-tgacedcav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e37b5ecb542a413c9b8b727f4bca98f634eb0b792f47d6522997f486487b947e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-ijos-afafiohah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bcc855c1b38e00f3e010eefb2f3301a87849b41093b520eebf49435284f864b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-jos-aafia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf93ad103a765f619a5d787d008a6c1d3c171a33b553a2078e8f72439f43662b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-jos-afafiofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35195bf589359995435b89f1b92b5008dd9b9ba7f1b8cb6153c27771960bfb8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-ks-afua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b613a8620d407bead4ca8466e7f733a1aa54fcf46376132f17e26da9b7b85bae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-koig-tmoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b1a4089fd58ef01c9fbf48e10bd06102b39b8a3e43cef24d740016338d08b62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-koig-tim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6ca3f5e850d8bd5c3531b1c5d280ea40fff6a18819abc720d1774fe97c00075 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-koig-tm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b70c5ad40f6211c37a16a7fee970f99a23120a6a4fd485a805f88d1187177ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kuloig-tgv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45fad3c317f7cc514747c4530b040bbce8fe7769b33394be472ed89ae27b4d71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-koig-timea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 566b4ee12862576022bd1df5032ba5864d37020187090bf5aec876465d7fe39b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kat-ihu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401662b1dcf1ce86735ff7b77e3283e697224dfa160dc13d35fa76af925b1399 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kg-tifffacfav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0caf3184bb437b8a797b85f0fa626b76271b47cb60b138f087dd24fa586192 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kuig-tnaav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c871d46320533cf44f20ca6345eee76fb7ccc7602d3ef75e794d407e5859c1f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...