Rejetto HTTP File Server 2.4.x - Template Injection

Rejetto HTTP File Server HFS 2.4.x inserts the multipart upload filename into the server-side template symbol map as %item-resource% without escaping. A filename containing the literal %item-resource% is substituted a second time by the sequential global replacement in xtpl, allowing a : sequence...

MAL-2025-26312 Malicious code in midway-xtpl (npm)

The package midway-xtpl was found to contain malicious code...

Malicious code in midway-xtpl (npm)

The package midway-xtpl was found to contain malicious code...

GHSA-W65V-HX54-XRQX Malicious Package in midway-xtpl

All versions of midway-xtpl contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that...

PT-2020-21542

Name of the Vulnerable Software and Affected Versions midway-xtpl versions affected versions not specified Description The issue concerns malicious code in the midway-xtpl package, which uploads system information to a remote server, downloads a file, and executes it. Any computer with this packa...