Elseta Vinci Protocol Analyzer

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate privileges and perform code execution on the affected system. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such...

Malicious code in evoplay-spinential (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 715a8e278031d52f48cc59f78dfd93253ecc47b831d67be2854158f1e977f77b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-26481

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions 6.0.0 through 10.0.0 Description: The issue allows a specially crafted request to inject scripts in the "Activity Feed Attachments" endpoint, which will then render in the feed, resulting in a cross-site...

A week in security (February 10 – February 16)

Last week on Malwarebytes Labs: A suicide reveals the lonely side of AI chatbots, with Courtney Brown Lock and Code S06E03 Apple ordered to grant access to users’ encrypted data Phishing evolves beyond email to become latest Android app threat Apple fixes zero-day vulnerability used in "extremely...

CVE-2025-0924 WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-0924 WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

GHSA-7G7F-62CF-Q66H

creationtimestamp| type| source ---|---|--- 2025-02-17 00:19:09+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/4615 2025-02-17 00:20:14+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/4620 2025-02-17 00:21:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/4625 2025-02-17 00:22:16+00:00...

WordPress plugin WP Activity Log 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-6813 · WordPress · Wp Activity Log

Name of the Vulnerable Software and Affected Versions: WP Activity Log plugin for WordPress versions up to, and including, 5.2.2 Description: The issue is related to Stored Cross-Site Scripting via the message parameter due to insufficient input sanitization and output escaping. This allows...

WordPress WP Activity Log plugin <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by zer0gh0st in WordPress Plugin WP Activity Log versions = 5.2.2...

CVE-2023-27012

creationtimestamp| type| source ---|---|--- 2025-02-14 10:05:58+00:00| seen| Telegram/YPd9jOc1W5QBJWC4avKUZMxMcGEJ1YmZAhAcRLo5OO4fhXc...

WordPress plugin HurryTimer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

mySCADA myPRO Manager

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary OS commands, upload files, and obtain sensitive information without providing associated credentials. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize...

CVE-2024-36291

creationtimestamp| type| source ---|---|--- 2025-02-12 22:17:35+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhz7bipeyl2z 2025-02-12 23:28:14+00:00| seen| https://infosec.exchange/users/cve/statuses/113993508057368728 2025-08-26 13:26:33+00:00| seen|...

WordPress WordPress Activity-o-meter plugin <= 1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WordPress Activity-o-meter versions = 1...

CVE-2024-13456

creationtimestamp| type| source ---|---|--- 2025-02-12 09:43:18+00:00| seen| https://infosec.exchange/users/cve/statuses/113990264091516755 2025-02-12 10:15:55+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhxwx2xoo72x 2025-02-12 11:11:17+00:00| seen|...

CVE-2024-57000

creationtimestamp| type| source ---|---|--- 2025-02-11 22:40:13+00:00| seen| https://infosec.exchange/users/cve/statuses/113987656907693602 2025-02-11 23:15:54+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhws2urr2u2a 2025-02-12 01:08:19+00:00|...

CVE-2024-21925

creationtimestamp| type| source ---|---|--- 2025-02-11 21:16:01+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwleill6j2z 2025-02-11 22:48:23+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113987689001851844 2025-02-11 23:04:34+00:00| seen|...

CVE-2024-52968

creationtimestamp| type| source ---|---|--- 2025-02-11 17:06:30+00:00| seen| https://infosec.exchange/users/cve/statuses/113986344744783139 2025-02-11 17:16:45+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhw5ynuuvt2x 2025-02-11 17:45:28+00:00| seen|...

PT-2025-9132 · Howen · Howen Vehicle Service System

Name of the Vulnerable Software and Affected Versions: Howen Vehicle Service System affected versions not specified Description: The issue is related to a directory traversal possibility. Exploitation of this issue could allow a remote attacker to perform network activity without user interaction...