3051 matches found
EUVD-2025-178948
Malicious code in extremophile-ophiuchus-rollup-plugin-subscription npm...
EUVD-2025-175487
Malicious code in xerxes-perseus-antd-subscription npm...
EUVD-2025-176154
Malicious code in subscription-firebase-buffer-json npm...
EUVD-2025-176564
Malicious code in sagitta-child-process-subscription-vuetify npm...
MAL-2025-186934 Malicious code in extremophile-ophiuchus-rollup-plugin-subscription (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d5814aeadd2075aafefcfdf7e08fa80138940a6d61e92b031d99103d60885e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186817 Malicious code in eris-perseus-subscription-iota (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b261a9fb861a3208da1f028fe4c2ebee2a90df3ce636dcd100ab6c0f0ceb8c2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176978
Malicious code in protractor-eclipse-ini-subscription npm...
CVE-2025-11994
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-11994 Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-11994 Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
EUVD-2025-124904
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-11994
The CVE-2025-11994 entry refers to the WordPress Easy Email Subscription plugin (versions up to and including 1.3) with an unauthenticated stored XSS via the name parameter due to insufficient input sanitization and output escaping. Wordfence’s report confirms this as a real vulnerability affecti...
CVE-2025-12901
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...
WordPress Easy Email Subscription plugin <= 1.3 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Easy Email Subscription versions = 1.3...
EUVD-2025-111643
Malicious code in lint-staged-xanadu-aldebaran-subscription npm...
EUVD-2025-116734
Malicious code in altair-subscription-flare-loglevel npm...
Malicious code in subscription-xml-jasmine-apollo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eabecc43d01c8587b8f2f53eb45388a9476cf274b7a7c45c565f45dddd21bef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in dione-subscription-winston-helios (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee660994a62fdbc5057c92951e6a2739b653f0b4ae38c2fef9fdced410d1b7b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...