MAL-2025-17993 Malicious code in data-x (npm)

The package data-x was found to contain malicious code...

MAL-2025-11315 Malicious code in @zalastax/nolb-eslint-config-x (npm)

The package @zalastax/nolb-eslint-config-x was found to contain malicious code...

MAL-2025-13068 Malicious code in @zalastax/nolb-passport-x (npm)

The package @zalastax/nolb-passport-x was found to contain malicious code...

MAL-2025-11772 Malicious code in @zalastax/nolb-graphql-x (npm)

The package @zalastax/nolb-graphql-x was found to contain malicious code...

MAL-2025-29928 Malicious code in project-7x1nt-kilo (npm)

The package project-7x1nt-kilo was found to contain malicious code...

MAL-2025-15333 Malicious code in baes-x (npm)

The package baes-x was found to contain malicious code...

MAL-2025-12704 Malicious code in @zalastax/nolb-node-x (npm)

The package @zalastax/nolb-node-x was found to contain malicious code...

MAL-2025-12749 Malicious code in @zalastax/nolb-nodebb-plugin-x (npm)

The package @zalastax/nolb-nodebb-plugin-x was found to contain malicious code...

CVE-2025-49554

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input,...

CVE-2025-8974 linlinjava litemall JSON Web Token JwtHelper.java hard-coded credentials

A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with th...

CVE-2025-8974

CVE-2025-8974 affects linlinjava litemall up to version 1.8.0, specifically the JwtHelper.java in the Wx API’s JSON Web Token Handler. The issue arises from manipulating the SECRET argument via the X-Litemall-Token input, resulting in hard-coded credentials. Exploitation can be remote; attack com...

CVE-2025-24766

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wproyal News Magazine X news-magazine-x allows PHP Local File Inclusion.This issue affects News Magazine X: from n/a through = 1.2.37...

CVE-2025-24766 WordPress News Magazine X <= 1.2.35 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wproyal News Magazine X news-magazine-x allows PHP Local File Inclusion.This issue affects News Magazine X: from n/a through = 1.2.37...

CVE-2025-24766 WordPress News Magazine X <= 1.2.35 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wproyal News Magazine X news-magazine-x allows PHP Local File Inclusion.This issue affects News Magazine X: from n/a through = 1.2.37...

CVE-2025-24766

CVE-2025-24766 : WordPress News Magazine X (WP Royal Themes) has an LFI flaw in PHP due to improper control of filenames for include/require. Affected: News Magazine X

CVE-2025-48861

A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps...

CVE-2025-27845

In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for elevated permissions to the UI...

PT-2025-33149 · Wp Royal Themes · News Magazine X

Name of the Vulnerable Software and Affected Versions: WP Royal Themes News Magazine X versions through 1.2.37 Description: A flaw exists in WP Royal Themes News Magazine X related to improper control of filename for include/require statements, leading to a PHP Local File Inclusion issue. This...

WordPress plugin News Magazine X 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2025-7739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions...