3819 matches found
MAL-2025-146205 Malicious code in phoenix-pipe-subscription-helios (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ce4d42780a7001aa44f3c101823bdbcade9d30f0ca76707a7e229a9f1072c0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-143632 Malicious code in init-subscription-callisto-europa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9394c2bac5a142593132709358a31dad622842e119d03316c93ad3dbbabad6a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-143309 Malicious code in hermes-concurrently-hermes-subscription (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e0fc504fe20b5d7a624bf4f16d4f30312aae20867a0ab2bca5a06e6e80bd777 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-149124 Malicious code in venus-subscription-pino-xml (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b084d77d240ddb72fc2468a96b8d733738ecf2c519fff700a0354752768c0774 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-141384 Malicious code in cygnus-subscription-sqlite-radiant (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2e2511e9f9a27ff95e6c98e35f610b47432ec0f22b1470e637ebe6d56afe7e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-141383 Malicious code in cygnus-subscription-loglevel-castor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a14f5f7acca2db1c52ece29d5ea1c8cc85499a0ac6b337fcb30226a7f4fe4e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-143663 Malicious code in inquirer-subscription-atlas-nestjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14c297373fbac2bb3f718616946a1c15d83903387e6bfb5a6ae10ad091ca530 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-148366 Malicious code in subscription-request-koa-scorpius (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c68b8002383770872ccdad0a33557462f10d80f27bd85d0cf04a9636bc71571 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-149560 Malicious code in wolf-pyxis-rollup-subscription (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 825b2089e674a1b4f07d988dd4dd46073f675eb1896bfdf21ad1489f1458389c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-140034 Malicious code in blaze-uglify-js-schema-subscription (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f8d5f1ce6793923e6a5f433e28c137a347dd3e3071b1cfcf658b2ec25fcd7b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...
CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...
CVE-2025-12901
The CVE-2025-12901 entry concerns the WordPress plugin Asgaros Forum. Reports across multiple sources confirm a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 3.2.1 caused by missing nonce validation in the set_subscription_level() function, enabling unauthenticated attacke...
CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...
PT-2025-46566
Name of the Vulnerable Software and Affected Versions Asgaros Forum plugin for WordPress versions prior to 3.2.2 Description The software is susceptible to Cross-Site Request Forgery CSRF. This is caused by a lack of nonce validation within the set subscription level function. An unauthenticated...
PT-2025-46648
Name of the Vulnerable Software and Affected Versions Easy Email Subscription plugin for WordPress versions up to and including 1.3 Description The software is susceptible to Stored Cross-Site Scripting through the name parameter. Insufficient input sanitization and output escaping allow...
WordPress plugin Easy Email Subscription 跨站脚本漏洞
The WordPress Easy Email Subscription plugin is a plugin for adding email subscription functionality to your WordPress website, allowing users to receive new content updates via email. WordPress Easy Email Subscription plugin suffers from a cross-site scripting vulnerability that stems from the...
CVE-2025-11994: Improper Neutralization of Input During Web Page Generation
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
WordPress plugin Asgaros Forum 跨站请求伪造漏洞
WordPress Asgaros Forum plugin is a lightweight forum plugin designed for WordPress that supports the rapid creation and management of forum pages, providing basic posting, replying, user management and other functions. The WordPress Asgaros Forum plugin suffers from a cross-site request forgery...
