MAL-2025-84910 Malicious code in eka-rawon95-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93e6a178087007fab0134ac85abfa47e455fce955b62b076ce8e117228cbae5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68308 Malicious code in feminist-harlequin-lion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac13ed9adccc10d3dc9a5581cd5adb71380525342b0cb47f351a22997ef8d335 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quixotic_kingfisher_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 501057b254c277a0d05cc3a19fcdf2ddcb3132fb54134272e38814159ff0f2a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-51342 Malicious code in cindy-jengkol40-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e188e390d19f2f4b8ffd5a0c2e00740784d3772e64a748b7c1612560934184d The package cindy-jengkol40-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-191930 Malicious code in wei516-ppa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d5a85017b397970606b9d2d5150a6f6ee8f71fdbd810fe6b0a8f34c577d76d1 Package seems to provide an MCP server, but in fact contains attempts to make an LLM agent break safeguards. As the request is about leaves just a flag, it see...

Malicious code in wayspiritmcp-tpa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 523cbbda7a0fda2addfcd432b1bfcc1df072ee67a593ffce535b7da7005caae8 Package seems to provide an MCP server, but in fact contains attempts to make an LLM agent break safeguards. As the request is about leaves just a flag, it see...

CVE-2025-11812

The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reusebuildersingleposttitle' shortcode in all versions up to, and including, 1.7. This is due to insufficient input sanitization and output escaping on the 'style' attribute. This makes it possible for...

WordPress plugin Reuse Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

PT-2025-44940

The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reuse builder single post title' shortcode in all versions up to, and including, 1.7. This is due to insufficient input sanitization and output escaping on the 'style' attribute. This makes it possible fo...

EUVD-2025-37424

The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitrary CSS styles submitted via the qi-blocks/v1/update-styles REST API endpoint without proper sanitization in the updateglobalstylescallbac...

EUVD-2025-37393

Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service DoS condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server’s...

CVE-2025-63561

Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service DoS condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server’s...

CVE-2025-63561

Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service DoS condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server’s...

CVE-2025-63561

Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service DoS condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server’s...

EUVD-2025-37263

Malicious code in style-tailwind-variant npm...

MAL-2025-49270 Malicious code in style-tailwind-variant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44577e5c235fe9163b6f47f81c7813a15491137478bb6ccbe5fe45ca911d17d1 The package style-tailwind-variant was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview style-tailwind-variant is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in style-tailwind-variant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44577e5c235fe9163b6f47f81c7813a15491137478bb6ccbe5fe45ca911d17d1 The package style-tailwind-variant was found to contain malicious code. Source: ghsa-malware...

CVE-2025-48096

Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through = 1.4.0...

CVE-2025-62697 Improperly sanitized style parameter in LanguageSelector

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39...