Malicious code in calendar-widget (npm)

The package calendar-widget was found to contain malicious code...

MAL-2025-26200 Malicious code in merchant-newsletter-widget (npm)

The package merchant-newsletter-widget was found to contain malicious code...

Malicious code in sedona-angular-widget-launcher (npm)

The package sedona-angular-widget-launcher was found to contain malicious code...

MAL-2025-23903 Malicious code in jquery.ui.widget.js (npm)

The package jquery.ui.widget.js was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-13992 Malicious code in ace-one-widget-self-hosting (npm)

The package ace-one-widget-self-hosting was found to contain malicious code...

MAL-2025-14733 Malicious code in appointment-widget (npm)

The package appointment-widget was found to contain malicious code...

MAL-2025-22626 Malicious code in hope-widget-xyz (npm)

The package hope-widget-xyz was found to contain malicious code...

MAL-2025-9589 Malicious code in @uxbrand-components/color-widget (npm)

The package @uxbrand-components/color-widget was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-7102 Malicious code in @avocado-team/app-center-app-widget (npm)

The package @avocado-team/app-center-app-widget was found to contain malicious code...

MAL-2025-36813 Malicious code in thingsboard-advanced-attribute-widget (npm)

The package thingsboard-advanced-attribute-widget was found to contain malicious code...

MAL-2025-39073 Malicious code in weixin-widget (npm)

The package weixin-widget was found to contain malicious code...

MAL-2025-17841 Malicious code in customer-appointment-detail-widget (npm)

The package customer-appointment-detail-widget was found to contain malicious code...

MAL-2025-14326 Malicious code in alloy-widget-npm (npm)

The package alloy-widget-npm was found to contain malicious code...

MAL-2025-19103 Malicious code in ebay-items-react-widget-server (npm)

The package ebay-items-react-widget-server was found to contain malicious code...

MAL-2025-9590 Malicious code in @uxbrand-components/illustration-widget (npm)

The package @uxbrand-components/illustration-widget was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Malicious code in thingsboard-advanced-attribute-widget (npm)

The package thingsboard-advanced-attribute-widget was found to contain malicious code...

GHSA-M5C7-5GV3-HCPF Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows...

Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the first display label field in the configuration of a custom sort widget. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting a malicious payload that is...

CVE-2025-43734

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows...