MAL-2025-36372 Malicious code in test-mlw2-sulks-proms (npm)

The package test-mlw2-sulks-proms was found to contain malicious code...

MAL-2025-39566 Malicious code in xanadu-k8mj8-aokcz-dew-project (npm)

The package xanadu-k8mj8-aokcz-dew-project was found to contain malicious code...

MAL-2025-8341 Malicious code in @lbnqduy/psychic-journey (npm)

The package @lbnqduy/psychic-journey was found to contain malicious code...

MAL-2025-35729 Malicious code in test-mlw2-lycee-weeny (npm)

The package test-mlw2-lycee-weeny was found to contain malicious code...

MAL-2025-8904 Malicious code in @malware-test-sculs-glory-lants-elder/test-mlw3-sculs-glory-lants-elder (npm)

The package @malware-test-sculs-glory-lants-elder/test-mlw3-sculs-glory-lants-elder was found to contain malicious code...

MAL-2025-7341 Malicious code in @crabas0npm/impedit-magnam-soluta (npm)

The package @crabas0npm/impedit-magnam-soluta was found to contain malicious code...

MAL-2025-7060 Malicious code in @amber-team/log-uptime-deploy (npm)

The package @amber-team/log-uptime-deploy was found to contain malicious code...

MAL-2025-40222 Malicious code in yangkuan (npm)

The package yangkuan was found to contain malicious code...

Exploit for CVE-2025-4404

CVE-2025-4404 POC POC for CVE-2025-4404 If you have a domain...

CVE-2025-54882

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials...

Himmelblau 安全漏洞

Himmelblau is an Azure Entra ID authentication module open-sourced by Himmelblau. A security vulnerability exists in Himmelblau versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, which stems from the Cloud TGT credential cache being stored as globally readable...

CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...

Exploits AD CS Template misconfigurations which involve updating an LDAP object: ESC9, ESC10, and ESC16

This module exploits Active Directory Certificate Services AD CS template misconfigurations, specifically ESC9, ESC10, and ESC16, by updating an LDAP object and requesting a certificate on behalf of a target user. The module leverages the auxiliary/admin/ldap/ldapobjectattribute module to update...

CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...

CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...

CVE-2025-52203

Summary: CVE-2025-52203 affects DevaslanPHP project-management v1.2.4 with a stored XSS in the Ticket Name field. An authenticated attacker can inject JavaScript, which is stored in the database and executes in a user’s browser context when they log in and are redirected to the Dashboard. The iss...

PT-2025-31555 · Unknown · Devaslanphp Project-Management

Name of the Vulnerable Software and Affected Versions: DevaslanPHP project-management version 1.2.4 Description: A stored cross-site scripting XSS issue exists in DevaslanPHP project-management version 1.2.4. The vulnerability is located in the Ticket Name field, which does not properly sanitize...

CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...

Zoo Management System /admin/add-foreigners-ticket.php File SQL Injection Vulnerability

Zoo Management System is a zoo management system. Zoo Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter cprice in the file /admin/add-foreigners-ticket.php. An attacker can exploit this...

Zoo Management System /admin/add-normal-ticket.php File SQL Injection Vulnerability

Zoo Management System is a zoo management system. Zoo Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter cprice in the file /admin/add-normal-ticket.php. An attacker can exploit this...