MAL-2025-63910 Malicious code in kurniawan-enting62-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05da15b684c08cb78a42b21ca101a6730679868326a556eb3c66f64948772299 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64581 Malicious code in occasional_rabbit_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46d5148c88c3dd5b84728f9fade5e18c9cbabff8811180e0a8ddd53563512700 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65973 Malicious code in vida-nasiuduk63-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cecb6ba4bf84b77a0edb3aa8d495af4dc7f200fd1bb5f2e6561204346ec1b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61809 Malicious code in agus-kacang62-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ad5ab3ac33f53ce245d061f1bd8db83d250b44befab0ef9dd343d735c0e807 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65533 Malicious code in tania-mangut50-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545607c836e3814d4a6ef9f54efa3cbef1985e8b5d0440f2a8267c3e8be12c8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62669 Malicious code in eka-lodeh44-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a89703a540bdec5e5cc3ea90ab70c79da5990510584913df457f9a63016f9dd8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66232 Malicious code in xaver-tapai75-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0235692d5ecd844daff1d7ef2872d4e1ea8f2d63f19a9ef6e6b3259c14f4a14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63988 Malicious code in laila-tomat34-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbd7ab5b2a11838f2d062e575ae2328f33ed77c12d032eaacb1bb31e730979eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65583 Malicious code in tiara-kupang97-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector effa81ae72b379eecc8fc576e65cc97dfc70ab7af9239db50f23d05bf71ed9ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64020 Malicious code in lina-kripik3-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b3ede2aa1cd6613c53ea652639e5865a757ebfee91b8ad463c268b039dab57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64094 Malicious code in lisa-naget9-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ce2fde0ea997326bc0c1aae115af2837c47b5c93bd310b8a4d6c3e823e2abf3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-saguer98-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3971993a5e8f074e653afbf7783e7dc9b02e98f5828b0a98c070661d80a5de47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64516 Malicious code in nina-tahutek1-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8811aad66bc4281f99a0f3cb00cea4bd7ec706fe0675ba1f8af180c4627c0ce1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66525 Malicious code in zul-lupis44-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fcb65e4678af516223789a6be7bfdae5801aea0ac80e5c2718fb47a544a30c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66383 Malicious code in yuni-mieaceh21-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b64393b4421a34dc8891fc2a7ce84aaa4ddc048bc13be18ca72d88572ca33a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46282

Name of the Vulnerable Software and Affected Versions Elastic Theme Editor plugin for WordPress versions up to and including 0.0.3 Description The Elastic Theme Editor plugin for WordPress is susceptible to arbitrary file uploads. This is due to a dynamic code generation feature within the proces...

CVE-2025-12637: Improper Control of Generation of Code

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

WordPress plugin Elastic Theme Editor 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code injection...

WordPress Elastic Theme Editor plugin <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by kr0d in WordPress Plugin Elastic Theme Editor versions = 0.0.3...

Malicious code in pretty_cattle_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 223511963dedc6872fefd68dda4a74f99e6c836ef4bd5a3d61f0f9e8248ae55a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...