Malicious code in eight-spend-men (npm)

The package eight-spend-men was found to contain malicious code...

MAL-2025-8947 Malicious code in @malware-test-spend-daman-mouth-haets/test-mlw3-spend-daman-mouth-haets (npm)

The package @malware-test-spend-daman-mouth-haets/test-mlw3-spend-daman-mouth-haets was found to contain malicious code...

Malicious code in test-mlw2-spend-daman-mouth-haets (npm)

The package test-mlw2-spend-daman-mouth-haets was found to contain malicious code...

Malicious code in test-mlw2-aloft-spend (npm)

The package test-mlw2-aloft-spend was found to contain malicious code...

MAL-2025-36304 Malicious code in test-mlw2-spend-daman-mouth-haets (npm)

The package test-mlw2-spend-daman-mouth-haets was found to contain malicious code...

MAL-2025-34865 Malicious code in test-mlw2-aloft-spend (npm)

The package test-mlw2-aloft-spend was found to contain malicious code...

SQL Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to SQL Injection via spendmanagementendpoints.py. An attacker could potentially inject malicious SQL code through unsanitized input, leading to unauthorized data access or...

fuels-ts 输入验证错误漏洞

fuels-ts is an open source library from Fuel Labs that interacts with Fuel v2. An input validation error vulnerability exists in fuels-ts, which is caused by the "fund" function in "fuels-ts/packages/account/src/account.ts" that uses the function The "getResourcesToSpend" function in...

How to Reduce SaaS Spend and Risk Without Impacting Productivity

There is one simple driver behind the modern explosion in SaaS adoption: productivity. We have reached an era where purpose-built tools exist for almost every aspect of modern business and it's incredibly easy and tempting for your workforce to adopt these tools without going through the formal I...

Evmos vulnerable to exploit of smart contract account and vesting

Summary This advisory board aims to describe two vulnerabilities found in the Evmos codebase: - Authorization check on the fundVestingAccount: unauthorized spend of funds. Details Authorization check on the fundVestingAccount With the current implementation, a user can create a vesting account wi...

GHSA-H6M6-JJ8V-94JJ SQL injection in litellm

An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidat...

CVE-2024-5225 SQL Injection in berriai/litellm

An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidat...

CVE-2024-5225

The CVE-2024-5225 issue affects litellm (LiteLLM) / berriai/litellm, specifically the /global/spend/logs endpoint, where the code builds an SQL query by directly concatenating an unvalidated api_key parameter. This SQL Injection vulnerability can lead to unauthorized access, data manipulation, ex...

PT-2024-35137

Name of the Vulnerable Software and Affected Versions berriai/litellm repository affected versions not specified Description An SQL Injection issue exists due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an...

Sail Further with Wiz Cost Optimization for Amazon EKS

Learn how Wiz's latest feature identifies outdated EKS clusters, helping organizations save millions on cloud spend. Find out how to optimize costs and reinvest savings in strategic initiatives...

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...

Online ID Generator 1.0 - Remote Code Execution Vulnerability

Title: Online ID Generator 1.0 - Remote Code Execution RCE Author: nu11secur1ty Vendor: https://www.youtube.com/watch?v=JdB9po5DTc Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/idgenerator0.zip Reference: https://portswigger.net/web-security/sql-injection...

soosyze 2.0.0 - File Upload Exploit

Title: soosyze 2.0.0 - File Upload Author: nu11secur1ty Vendor: https://soosyze.com/ Software: https://github.com/soosyze/soosyze/releases/tag/2.0.0 Reference: https://portswigger.net/web-security/file-upload Description: Broken file upload logic. The malicious user can upload whatever he wants t...

Soosyze 2.0.0 Arbitrary File Upload

Title: soosyze 2.0.0 - File Upload Author: nu11secur1ty Date: 04.26.2023-08.28.2023 Vendor: https://soosyze.com/ Software: https://github.com/soosyze/soosyze/releases/tag/2.0.0 Reference: https://portswigger.net/web-security/file-upload Description: Broken file upload logic. The malicious user ca...

Default coin spend limit was set wrong for ETH

Lines of code Vulnerability details Impact It is stated in the README that some spend limit are configured for the swaps. This is a security precaution to avoid spending too much tokens for the default 4 CANTO tokens in order to onboard the users if their balance is less than 4 tokens. As a...