Malicious code in maybe-i-would-like-a-banana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 662fcbfd490d5409f2a17a156785c7d82b81e2c57e0c67d1ae701ccf49fff1b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in validate-rb (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7975ebc737a4c604d0d25ee00a187fde74d2442953ec305c57c738ebd4cdedcd The OpenSSF Package Analysis project identified 'validate-rb' @ 1.0.0...

CVE-2025-53267

CVE-2025-53267 is a CSRF vulnerability in the WordPress plugin “Hide Admin Bar From Front End” affecting version 1.0.0 and earlier. The connected sources describe a Cross-Site Request Forgery issue without publicly documented exploit vectors or confirmed fixes in the provided documents. Several s...

CVE-2025-52808 WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in real-web RealtyElite realtyelite allows PHP Local File Inclusion.This issue affects RealtyElite: from n/a through = 1.0.0...

WordPress plugin CTUsers 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin RealtyElite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin Hide Admin Bar From Front End 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in WordPress...

CVE-2025-6290

The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh in WordPress Theme RealtyElite versions = 1.0.0...

Malicious code in fooldepend9f218a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2d68aea54197ae7455406cdcc725402bd69770cce80a8958ec4d1627b67a2814 The OpenSSF Package Analysis project identified 'fooldepend9f218a' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Hope-Boot 安全漏洞

Hope-Boot is a modern scaffolding project by the individual developer java-aodeng. A security vulnerability exists in Hope-Boot version 1.0.0, which stems from the mishandling of the parameter errorMsg by the Login function in WebController.java, which could lead to a cross-site scripting attack...

CVE-2025-52794

Cross-Site Request Forgery CSRF vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through = 1.0.0...

CVE-2025-52794 WordPress Creative Contact Form plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through = 1.0.0...

XAgent 路径遍历漏洞

XAgent is an open source experimental Large Language Model LLM-driven autonomous agent from OpenBMB. A path traversal vulnerability exists in XAgent 1.0.0 and earlier versions, which stems from a path traversal in the file /conv/community...

PT-2025-26218 · Unknown · Zhilink Adp Application Developer Platform

Name of the Vulnerable Software and Affected Versions: zhilink ADP Application Developer Platform version 1.0.0 Description: A critical issue affects the processing of the file /adpweb/a/base/barcodeDetail/. The manipulation of the argument barcodeNo/barcode/itemNo leads to SQL injection. The...

Malicious code in worldhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c09616d1a3cf63c69efe5b81863fee024898fd16025a96efa3e70504012bb6bd The OpenSSF Package Analysis project identified 'worldhello' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package execut...

Malicious code in o11y-ds-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fca3e674d984eeb8be380f95b3033584360c55efdc438f8f43c521b0d7239f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in client-vue3-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 949b1148db60c58f37c8fec03067aa1974329c0f5719de4425b8840f213b5f2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in getsourcefile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44a69b03b0d5efbf48210cf0f786f2653910ba129aa89e00c5cd6a995f6ee9df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

📄 WordPress Likes and Dislikes 1.0.0 SQL Injection

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the post parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...