1043 matches found
MAL-2025-49272 Malicious code in telegram-bot-starter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c6146ccba5593f3f123cbe20b94fd9df9d168c3e4614e5bf93a1fdd8e96fc7d The package telegram-bot-starter was found to contain malicious code. Source: ghsa-malware...
Malicious code in epic-react-webpack-starter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0612e1df4e8b41525b76bc21bc0fa1cc725bfbcf9e2cd32d80b83e44a219e14d The package epic-react-webpack-starter was found to contain malicious code...
MAL-2025-49188 Malicious code in epic-react-webpack-starter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0612e1df4e8b41525b76bc21bc0fa1cc725bfbcf9e2cd32d80b83e44a219e14d The package epic-react-webpack-starter was found to contain malicious code...
Modularizing Spring Boot
Continuing our Road to GA series, this week we're exploring the modularization effort happening with Spring Boot 4. When Spring Boot 1.0 was released in 2014, it shipped with a single spring-boot-autoconfigure jar weighing in at 182 KiB. Of course, that initial version didn't support a great deal...
Malicious code in astra-db-chatbot-starter (npm)
The package astra-db-chatbot-starter was found to contain malicious code...
MAL-2025-48614 Malicious code in astra-db-chatbot-starter (npm)
The package astra-db-chatbot-starter was found to contain malicious code...
WordPress Beaver Builder Plugin (Starter Version) plugin <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play' vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'autoplay' vulnerability discovered by Sulabh Jain pentestmonkey11 in WordPress Plugin Beaver Builder Plugin Starter Version versions = 2.9.2.1...
CVE-2025-8427
The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
CVE-2025-8427
The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
CVE-2025-8427 Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'
The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
CVE-2025-8427 Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'
The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
CVE-2025-8427
Beaver Builder Plugin (Starter Version) for WordPress (
PT-2025-43511
Name of the Vulnerable Software and Affected Versions Beaver Builder Plugin Starter Version versions through 2.9.2.1 Description The Beaver Builder Plugin Starter Version for WordPress is susceptible to Stored Cross-Site Scripting through the auto play parameter. Insufficient input sanitization a...
CVE-2025-8427: Improper Neutralization of Input During Web Page Generation
The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via multiple APIs in OpenAPIController. An attacker can gain unauthorized access to sensitive information by sending crafted requests to the endpoints. Remediation There is no fixed version for...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the list function in UserInfoController.java. An attacker can access sensitive user information by sending unauthorized requests remotely. Remediation There is no fixed version for...
EUVD-2025-32969
Malicious code in astra-db-recommendations-starter npm...
Malicious Package
Overview astra-db-recommendations-starter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
Malware in astra-db-recommendations-starter
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...