WordPress Uni CPO (Premium) plugin <= 4.9.54 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file' vulnerability

Unauthenticated Arbitrary File Upload via 'unicpouploadfile' vulnerability discovered by Ren Voza in WordPress Plugin Uni CPO Premium versions = 4.9.54...

Malicious Package

Overview next-plugin-uni-i18n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-47107 Malicious code in vite-plugin-uni-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ff6cfac329bcb3bc726e87d12942ec29cd686c4d4e81223398ed26948b46e39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uni-help (npm)

The package uni-help was found to contain malicious code...

Malicious code in @zalastax/nolb-_uni- (npm)

The package @zalastax/nolb-uni- was found to contain malicious code...

Malicious code in @zalastax/nolb-_uni_ (npm)

The package @zalastax/nolb-uni was found to contain malicious code...

@uni-cli/cli (>=1.0.6 <=1.0.12), @uni-cli/init (=1.0.12) +1 more potentially affected by unknown CVE via fs-extar (=0.0.1-security)

fs-extar NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on fs-extar and may be impacted: - @uni-cli/cli =1.0.6, =1.0.12 - @uni-cli/init =1.0.12 - hwsz-tools =1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-21006...

MAL-2025-10541 Malicious code in @zalastax/nolb-_uni- (npm)

The package @zalastax/nolb-uni- was found to contain malicious code...

MAL-2025-10542 Malicious code in @zalastax/nolb-_uni_ (npm)

The package @zalastax/nolb-uni was found to contain malicious code...

MAL-2025-37741 Malicious code in uni-help (npm)

The package uni-help was found to contain malicious code...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS advisories on July 15, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-196-01 Hitachi Energy Asset Suite ICSA-25-196-02 ABB RMC-100 ICSA-25-196-03 LITEON IC48A...

CVE-2023-6441

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in UNI-PA University Marketing & Computer Internet Trade Inc. University Information System allows SQL Injection. This issue affects University Information System: before 12.12.2023...

CVE-2023-22279

MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote unauthenticated attacker to execute an arbitrary OS command...

Planet UNI-NMS-Lite Trust Management Issues Vulnerability

Planet UNI-NMS-Lite is a universal network management system from PLANET China that monitors all deployed wired or wireless PoE industrial grade network devices. Planet UNI-NMS-Lite is vulnerable to a trust management issue that can be exploited by an attacker to submit a special request that can...

CVE-2025-46273

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices...

The vulnerability of the UNI-NMS-Lite network management system, which stems from the use of rigidly encrypted account data, allows a hacker to elevate their privileges to the level of an administrator.

The vulnerability of the UNI-NMS-Lite network management system is related to the use of strictly encrypted account data. Exploiting this vulnerability can allow a malicious actor to elevate their privileges to the level of an administrator...

CVE-2025-46271

UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data...

CVE-2025-46273

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices...

CVE-2025-46274

Planet UNI-NMS-Lite is affected by CVE-2025-46274, a vulnerability arising from hard-coded credentials that could allow an unauthenticated attacker to read, manipulate, and create entries in the managed database. The risk is described as CRITICAL with network attack vector and no user interaction...

CVE-2025-46273

The CVE-2025-46273 entry concerns Planet UNI-NMS-Lite. Connected sources confirm a vulnerability in UNI-NMS-Lite involving hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges on all UNI-NMS managed devices, and also document a command-injection pa...