MAL-2025-143663 Malicious code in inquirer-subscription-atlas-nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14c297373fbac2bb3f718616946a1c15d83903387e6bfb5a6ae10ad091ca530 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140664 Malicious code in changelog-concurrently-subscription-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83b2e12272a8e785079ce5d459cca1a904c1e9310d88115531e97fbf868592c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146533 Malicious code in private-halley-nodejs-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89a15a54cc1eb0ce2d148b3ff7677e250f4387a0900f4a6bdb4e0858a664f377 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144776 Malicious code in mdx-rimraf-subscription-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3ae0dfc03d7ef3da474f94bfe9820f5263c24effedec038236376a4ddf6da29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114750

Malicious code in csv-subscription-apollo-meissa npm...

EUVD-2025-113619

Malicious code in firebase-cressida-commitlint-subscription npm...

MAL-2025-148366 Malicious code in subscription-request-koa-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c68b8002383770872ccdad0a33557462f10d80f27bd85d0cf04a9636bc71571 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140034 Malicious code in blaze-uglify-js-schema-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f8d5f1ce6793923e6a5f433e28c137a347dd3e3071b1cfcf658b2ec25fcd7b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141529 Malicious code in delphinus-subscription-mongodb-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bac142598e41e269f280ed6117a0efa39ee9665215459c5818a45e39613e47f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143950 Malicious code in jovian-izar-subscription-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8681257e1e1eff9e0b4be2eb9aaee7190c6c99222e20e0f2d9e0508d2fee6c20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146651 Malicious code in promise-subscription-pipe-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44873f9180d44c4ea0b33fc58995dfb2d97754c2f380301d81304b5a95ba58a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

CVE-2025-12901

The CVE-2025-12901 entry concerns the WordPress plugin Asgaros Forum. Reports across multiple sources confirm a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 3.2.1 caused by missing nonce validation in the set_subscription_level() function, enabling unauthenticated attacke...

CVE-2025-12901 Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

PT-2025-46566

Name of the Vulnerable Software and Affected Versions Asgaros Forum plugin for WordPress versions prior to 3.2.2 Description The software is susceptible to Cross-Site Request Forgery CSRF. This is caused by a lack of nonce validation within the set subscription level function. An unauthenticated...

PT-2025-46648

Name of the Vulnerable Software and Affected Versions Easy Email Subscription plugin for WordPress versions up to and including 1.3 Description The software is susceptible to Stored Cross-Site Scripting through the name parameter. Insufficient input sanitization and output escaping allow...

WordPress plugin Easy Email Subscription 跨站脚本漏洞

The WordPress Easy Email Subscription plugin is a plugin for adding email subscription functionality to your WordPress website, allowing users to receive new content updates via email. WordPress Easy Email Subscription plugin suffers from a cross-site scripting vulnerability that stems from the...

CVE-2025-11994: Improper Neutralization of Input During Web Page Generation

The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress plugin Asgaros Forum 跨站请求伪造漏洞

WordPress Asgaros Forum plugin is a lightweight forum plugin designed for WordPress that supports the rapid creation and management of forum pages, providing basic posting, replying, user management and other functions. The WordPress Asgaros Forum plugin suffers from a cross-site request forgery...