rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-59103 Weak Default Passwords for SSH Access in dormakaba access manager
The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users with hardcoded and weak passwords that can be used to access the devices via SSH. The passwords can be also guessed very easily. The password of at least one user is set to a random value after the first deployment, with the restriction that the password is only randomized if the configured date is prior to 2022. Therefore, under certain circumstances, the passwords are not randomized. For example, if the clock is never set on the device, the battery of the clock module has been changed, the Access Manager has been factory reset and has not received a time yet.
Problem types: cwe_id: CWE-1391
description: CWE-1391: Use of Weak Credentials
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:05:45.768Z
CVE-2025-59104 Unlocked Bootloader in dormakaba access manager
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through this vulnerability.
Problem types: cwe_id: CWE-1234
description: CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks
Affected products: vendor: dormakaba
product: Access Manager 92xx-k7
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:05:54.218Z
CVE-2025-59105 Unencrypted Flash Storage in dormakaba access manager
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and read, in order to gain SSH root access on the Linux-based K7 model. On the Windows CE based K5 model, the password for the Access Manager can additionally be read in plain text from the stored SQLite database.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: affected
vendor: dormakaba
product: Access Manager 92xx-k7
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:06:02.727Z
CVE-2025-59106 Web Server Running with Root Privileges in dormakaba access manager
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
Problem types: cwe_id: CWE-272
description: CWE-272: Least Privilege Violation
Affected products: vendor: dormakaba
product: Access Manager 92xx-k7
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:06:13.702Z
CVE-2025-59107 Static Firmware Encryption Password in dormakaba access manager
Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: affected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:06:22.025Z
CVE-2025-59108 Weak Default Passwords in dormakaba access manager
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.
Problem types: cwe_id: CWE-1392
description: CWE-1392: Use of Default Credentials
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: affected
vendor: dormakaba
product: Access Manager 92xx-k7
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:06:31.533Z
CVE-2025-59109 UART Leaking Sensitive Data in dormakaba registration unit 9002
The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).
Problem types: cwe_id: CWE-1295
description: CWE-1295: Debug Messages Revealing Unnecessary Information
Affected products: vendor: dormakaba
product: dormakaba registration unit 9002
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:06:45.739Z
CVE-2025-59110 Cross-Site Request Forgery in Windu CMS
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is worth noting that the registration is open and anyone can create an account.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: JCD
product: Windu CMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-11-18T13:26:29.098Z
CVE-2025-59111 Broken Access Control in Windu CMS
Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: JCD
product: Windu CMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-11-18T13:26:39.486Z
CVE-2025-59112 Cross-Site Request Forgery in Windu CMS
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send POST request that deletes given user.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: JCD
product: Windu CMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-11-18T13:26:31.060Z
CVE-2025-59113 Bruteforce Protection Bypass in Windu CMS
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: JCD
product: Windu CMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-11-18T13:26:31.504Z
CVE-2025-59114 Cross-Site Request Forgery in Windu CMS
Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send malicious file to the server.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: JCD
product: Windu CMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-11-18T13:26:31.881Z
CVE-2025-59115 Stored XSS in Windu CMS
Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Malicious attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting logs page by admin.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: JCD
product: Windu CMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-11-18T13:26:32.325Z
CVE-2025-59116 User enumeration in Windu CMS
Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Problem types: cwe_id: CWE-204
description: CWE-204 Observable Response Discrepancy
Affected products: vendor: JCD
product: Windu CMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-11-18T13:26:56.775Z
CVE-2025-59117 Multiple Stored XSS in Windu CMS
Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. 
This vulnerability can be exploited by a privileged user and may target users with higher privileges.

Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: JCD
product: Windu CMS
default_status: unaffected
Credits: lang: en
value: Karol Czubernat
Published: 2025-11-18T13:26:33.240Z
CVE-2025-59118 Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.03.

Users are recommended to upgrade to version 24.09.03, which fixes the issue.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Apache Software Foundation
product: Apache OFBiz
default_status: unaffected
Credits: lang: en
value: RedHive Team (security@hive.red) https://hive.red/en/
Published: 2025-11-12T09:15:54.263Z
CVE-2025-59129 WordPress Appointify plugin <= 1.0.8 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injection.This issue affects Appointify: from n/a through <= 1.0.8.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: appointify
product: Appointify
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: 0xVenus | Patchstack Bug Bounty Program
Published: 2025-12-30T16:51:35.844Z
CVE-2025-59130 WordPress Appointify plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a through <= 1.0.8.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: appointify
product: Appointify
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: 0xVenus | Patchstack Bug Bounty Program
Published: 2025-12-31T16:06:06.815Z
CVE-2025-59131 WordPress WP-CalDav2ICS plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2ICS: from n/a through <= 1.3.4.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: hoernerfranz
product: WP-CalDav2ICS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Muhammad Nur Ibnu Hubab | Patchstack Bug Bounty Program
Published: 2025-12-30T22:55:32.248Z
CVE-2025-59132 WordPress Duplicate Content Cure plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Badi Jones Duplicate Content Cure duplicate-content-cure allows Cross Site Request Forgery.This issue affects Duplicate Content Cure: from n/a through <= 1.0.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Badi Jones
product: Duplicate Content Cure
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Nur Ibnu Hubab | Patchstack Bug Bounty Program
Published: 2025-12-09T14:52:18.582Z
CVE-2025-59134 WordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme <= 1.5.8 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allows Privilege Escalation.This issue affects Sale! Immigration law, Visa services support, Migration Agent Consulting: from n/a through <= 1.5.8.
Problem types: cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: Jthemes
product: Sale! Immigration law, Visa services support, Migration Agent Consulting
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
Published: 2025-12-18T07:21:59.917Z
CVE-2025-59135 WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: eleopard
product: Behance Portfolio Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Nguyen Tran Tuan Dung (domiee13) | Patchstack Bug Bounty Program
Published: 2025-12-31T17:20:09.618Z
CVE-2025-59136 WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through <= 3.1.3.
Problem types: cwe_id: CWE-201
description: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Efí Bank
product: Gerencianet Oficial
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Legion Hunter | Patchstack Bug Bounty Program
Published: 2025-12-31T15:24:15.816Z
CVE-2025-59137 WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: eleopard
product: Behance Portfolio Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Muhammad Nur Ibnu Hubab | Patchstack Bug Bounty Program
Published: 2025-12-31T04:33:22.492Z
CVE-2025-59138 WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from n/a through <= 1.6.6.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF)
Affected products: vendor: Jthemes
product: Genemy
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
Published: 2025-12-31T17:03:59.500Z
CVE-2025-59139 Hono has Body Limit Middleware Bypass
Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the `Content-Length` header even when a `Transfer-Encoding: chunked` header was also included. According to the HTTP specification, `Content-Length` must be ignored in such cases. This discrepancy could allow oversized request bodies to bypass the configured limit. Most standards-compliant runtimes and reverse proxies may reject such malformed requests with `400 Bad Request`, so the practical impact depends on the runtime and deployment environment. If body size limits are used as a safeguard against large or malicious requests, this flaw could allow attackers to send oversized request bodies. The primary risk is denial of service (DoS) due to excessive memory or CPU consumption when handling very large requests. The implementation has been updated to align with the HTTP specification, ensuring that `Transfer-Encoding` takes precedence over `Content-Length`. The issue is fixed in Hono v4.9.7, and all users should upgrade immediately.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: honojs
product: hono
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-09-12T13:03:05.777Z
CVE-2025-59140 backslash@0.2.1 contains malware after npm account takeover
backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues is resolved in 0.2.2.
Problem types: cwe_id: CWE-506
description: CWE-506: Embedded Malicious Code
Affected products: vendor: Qix-
product: node-backslash
Published: 2025-09-15T19:09:53.500Z