The npm package 'm98th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The m98bet npm package contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, secure machine. Removal of the package alone does not guarantee eradication of all malicious software introduced by it.
The npm package '789bet' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected machine. Removal of the package alone may not eliminate all malicious software introduced by its installation.
CVE-2026-112256 is a critical vulnerability in OpenText Advanced Authentication Server that allows acceptance of extraneous untrusted data alongside trusted data. This flaw leads to accessing functionality not properly constrained by access control lists (ACLs), potentially enabling unauthorized actions. The vulnerability affects versions from 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0. Fixed versions are 6.4.3.9, 6.5.0.11, and 6.6.2.0. The CVSS 4.0 score is 9.2, indicating a critical severity level.
A path traversal vulnerability exists in the MasterStudy LMS plugin for WordPress versions before 3.7.50. Authenticated users with Subscriber-level privileges can exploit this flaw by supplying directory traversal sequences in a specific AJAX parameter, allowing them to import arbitrary WXR XML files. This enables attackers to publish posts with attacker-controlled content under their identity without proper capability checks or nonce verification.
A missing authorization vulnerability exists in Cozmoslabs Profile Builder up to version 4.0.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability does not impact confidentiality or availability but can affect data integrity.
The MasterStudy LMS plugin for WordPress versions before 3.7.50 has a missing authorization vulnerability. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without proper capability or nonce validation. Exploitation can lead to an uncaught PHP fatal error that may disclose the absolute filesystem path of the plugin if PHP error display is enabled.
A Missing Authorization vulnerability (CWE-862) exists in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons up to version 3.4.2. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact with low confidentiality impact and no integrity or availability impact.
A missing authorization vulnerability exists in the WP User Frontend plugin by weDevs, affecting versions up to 4.3.13. This flaw allows attackers with limited privileges to exploit incorrectly configured access control levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3. No patch or official fix information is currently provided.
A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw could enable unauthorized access to certain functions or data within the affected software.
A missing authorization vulnerability exists in the miniOrange Page Restriction WordPress plugin up to version 1.6.1. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.
A missing authorization vulnerability exists in the WP User Frontend plugin by weDevs, affecting versions up to 4.3.13. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact primarily on integrity without affecting confidentiality or availability.
A Missing Authorization vulnerability exists in StylemixThemes MasterStudy LMS up to version 3.7.55. This flaw involves incorrectly configured access control security levels, potentially allowing unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.
A missing authorization vulnerability exists in Kit Kit (formerly ConvertKit) up to version 3.4.7. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain resources or functions. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.
A DOM-Based Cross-site Scripting (XSS) vulnerability exists in David Lingren's Media Library Assistant up to version 3.42. This vulnerability involves improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the context of the affected web application.
An authorization bypass vulnerability exists in EventPrime EventPrime eventprime-event-calendar-management, allowing privilege abuse via a user-controlled key. This affects versions up to 4.3.6.0. The vulnerability has a medium severity with a CVSS score of 5.4.
A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetElements For Elementor up to version 2.9.2.6. This flaw involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.
A Cross-Site Request Forgery (CSRF) vulnerability exists in WPFunnels up to version 3.13.5. This vulnerability allows an attacker to induce a user to perform unwanted actions on a web application in which they are authenticated. The CVSS score is 4.3, indicating a medium severity level with low complexity and no privileges required for exploitation.
A missing authorization vulnerability in the weDevs WP ERP plugin (up to version 1.17.10) allows exploitation of incorrectly configured access control security levels. This flaw could permit users with limited privileges to access certain functionality or data without proper authorization. The vulnerability has a CVSS score of 4.3, indicating a medium severity impact primarily affecting confidentiality. No public exploits or patches are currently documented.
A stored cross-site scripting (XSS) vulnerability exists in weDevs Happy Addons for Elementor up to version 3.50.1. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with potential confidentiality, integrity, and availability consequences. No patch or fix information is currently provided.