CVE-2025-5150

creationtimestamp| type| source ---|---|--- 2025-05-25 15:21:55+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpyxlq2vzqc2 2025-05-25 15:45:58+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17508 2025-05-25...

CVE-2025-5149

creationtimestamp| type| source ---|---|--- 2025-05-25 13:46:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17507 2025-05-25 13:47:10+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpysc56jl7c2 2025-05-25...

MAL-2025-4421 Malicious code in ghpglobaldata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98f6628f3ea3766cb44c71cab1c1a8301235db7c97a186af48166d59c09863c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2018-9175

creationtimestamp| type| source ---|---|--- 2025-05-25 00:46:15+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17501 2025-05-25 00:57:40+00:00| seen| https://bsky.app/profile/bluesky.awakari.com/post/3lpxhcqjiff2e 2025-05-25 00:57:46+00:00| seen|...

Chanjet CRM injection vulnerability

Chanjet CRM is a Customer Relationship Management system from China Changjitong Chanjet. An injection vulnerability exists in Chanjet CRM 20250510 and earlier versions, which originates from SQL injection due to incorrect operation of the parameter gblOrgID in the file...

CVE-2025-5152: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in Chanjet CRM up to 20250510. This vulnerability affects unknown code of the file /activity/newActivityedit.php?DontCheckLogin=1&id=null&ret=mod1. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated...

CVE-2025-5135

creationtimestamp| type| source ---|---|--- 2025-05-24 22:45:35+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17497 2025-05-24 23:11:46+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpxb7kdrdlo2 2025-05-25...

CVE-2025-4223

creationtimestamp| type| source ---|---|--- 2025-05-24 05:03:12+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpvekmsbrpb2 2025-05-24 09:30:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpvtj474rf2r...

CVE-2025-4602

creationtimestamp| type| source ---|---|--- 2025-05-24 04:02:11+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpvb2ovbklj2 2025-05-24 04:52:39+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17480...

CVE-2025-3869

creationtimestamp| type| source ---|---|--- 2025-05-24 02:53:42+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpv5d7gt4yw2...

CVE-2024-0868

The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value...

Scarcity signals: Are rare activities red flags?

By Darin Smith and John Arneson Cisco Talos reviewed six months of network connection telemetry logs spanning June 1, 2024 - Dec. 31, 2024, containing 3,220,829 log events and 742 unique base domains, to explore if domains that PowerShell rarely contacts are more likely to be malicious. Key...

CVE-2024-3257

A vulnerability was found in SourceCodester Internship Portal Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/editactivityquery.php. The manipulation of the argument title/description/start/end leads to sql injection. The...

CVE-2024-38293

ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php...

CVE-2024-3256

A vulnerability has been found in SourceCodester Internship Portal Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/editactivity.php. The manipulation of the argument activityid leads to sql injection. The attack can be...

CVE-2024-23211

A privacy issue was addressed with improved handling of user preferences. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, watchOS 10.3. A user's private browsing activity may be visible in Settings...

CVE-2024-36064

The NLL com.nll.cb aka ACR Phone application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.nll.cb.dialer.dialer.DialerActivity component...

CVE-2024-0025

In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-28593

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

CVE-2024-37929

Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4...