CVE-2026-12965

The Super Store Finder WordPress plugin (versions before 7.11 ) is vulnerable to unauthenticated SQL injection due to improper sanitization of a parameter within an unauthenticated AJAX action . An attacker can exploit this flaw to perform SQL injection and extract data from the database. The vul...

CVE-2026-12965 Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database...

Malicious code in zztemp-ssf-2605 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-9976 Malicious code in zztemp-ssf-2605 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @apple-pay-trust/finish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9abd2d210c4a5df0e95f326e80b2e6618647c03ba4158e1d6ffbd36d9f7b800a The package @apple-pay-trust/finish was found to contain malicious code. Source: ghsa-malware...

Malicious code in tsdoc-build-rig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa9483578294aa1f05417210a36c0840de9fe1104aa1c36c6cad6f0ac4fe4760 The package tsdoc-build-rig was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ssf-desktop-api-specification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b483f1c94deb76e7655d38cf4abdc31f984c39ed008ad293ea7614387704d3 The package ssf-desktop-api-specification was found to contain malicious code...

MAL-2026-1855 Malicious code in ssf-desktop-api-specification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b483f1c94deb76e7655d38cf4abdc31f984c39ed008ad293ea7614387704d3 The package ssf-desktop-api-specification was found to contain malicious code...

Malicious code in ssf-desktop-api-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49396220b88ccf03b280b2ccbf09f84a3c871d1877ca7db06fd0e3fb78221305 The package ssf-desktop-api-electron was found to contain malicious code...

MAL-2026-1854 Malicious code in ssf-desktop-api-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49396220b88ccf03b280b2ccbf09f84a3c871d1877ca7db06fd0e3fb78221305 The package ssf-desktop-api-electron was found to contain malicious code...

EUVD-2025-201555

Malicious code in ssf-desktop-api-browser npm...

MAL-2025-192359 Malicious code in ssf-desktop-api-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5940c26ac6aa2f9c3682f4d383922757d2d5c361b5a70140ca289eabe304be8d The package ssf-desktop-api-browser was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2025-201562

Malicious code in ssf-desktop-api-openfin npm...

Malicious code in ssf-desktop-api-openfin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367b2689b7d50c48e26747ef1edce3a36165d64fd361ad3fc19f1c52fce204f9 The package ssf-desktop-api-openfin was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in actions-run-service (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0096c4c86f75bd5815b589d90393b9d5efa12ac9fdae99a2cb6293475de0cbf8 The OpenSSF Package Analysis project identified 'actions-run-service' @ 0.0.1.r2301dc6 rubygems as malicious. It is considered malicious because...

MAL-2025-42486 Malicious code in @eooce/sbx (npm)

The package @eooce/sbx was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c3f68a08af76f3c5412daa2b25a618ab31f5541ee496dec1392afedcf86ec33 The OpenSSF Package Analysis project identified '@eooce/sbx' @ 2.0.7 npm as maliciou...

WordPress plugin Simple Signup Form SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A SQL injection...

PT-2025-6579

Name of the Vulnerable Software and Affected Versions Simple Signup Form plugin for WordPress versions up to, and including, 1.6.5 Description The issue is related to SQL Injection via the id attribute of the ssf shortcode. This is due to insufficient escaping on the user-supplied parameter and...

CVE-2024-13595: Improper Neutralization of Special Elements used in an SQL Command

The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including, 1.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

Malicious code in lyft-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 191527fd54bb2116b8405e7655ca0fa98138ea2f8f4463ca288460aeb3d1caf9 The OpenSSF Package Analysis project identified 'lyft-internal' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...