CVE-2025-44108

A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently...

CVE-2025-44108

A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently...

CVE-2025-44108

FlatPress CMS ≤ 1.3.1/1.4-rc1 shows a stored XSS through the gallery captions component. The vulnerability (CVE-2025-44108) allows an admin-privilged user to inject JavaScript that is then stored persistently, with impacts limited to confidentiality and integrity per sources, and no explicit expl...

How the Signal Knockoff App TeleMessage Got Hacked in 20 Minutes

The company behind the Signal clone used by at least one Trump administration official was breached earlier this month. The hacker says they got in thanks to a basic misconfiguration...

PHPGurukul Online Course Registration 安全漏洞

Online Course Registration is an online course registration system. Online Course Registration suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter department in the file /admin/department.php. An attacker can...

CVE-2025-2570 System Admin Cannot Access Environment settings in System Console While System Manager Can

Mattermost versions 10.5.x = 10.5.3, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...

US Customs and Border Protection Plans to Photograph Everyone Exiting the US by Car

A CBP spokesperson tells WIRED that the agency plans to expand its program for real-time face recognition at the border, potentially aiding Trump administration efforts to track people who self-deport...

CVE-2025-29602

flatpress 1.3.1 is vulnerable to Cross Site Scripting XSS in Administration area via Manage categories...

CVE-2025-45818

Slims Senayan Library Management Systems 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/masterfile/itemstatus.php...

The Trump Administration Sure Is Having Trouble Keeping Its Comms Private

In the wake of SignalGate, a knockoff version of Signal used by a high-ranking member of the Trump administration was hacked. Today on Uncanny Valley, we discuss the platforms used for government communications...

CVE-2025-29602

flatpress 1.3.1 is vulnerable to Cross Site Scripting XSS in Administration area via Manage categories...

CVE-2025-29602

flatpress 1.3.1 is vulnerable to Cross Site Scripting XSS in Administration area via Manage categories...

CVE-2025-29602

flatpress 1.3.1 is vulnerable to Cross Site Scripting XSS in Administration area via Manage categories...

FlatPress 安全漏洞

FlatPress is a lightweight, easy-to-setup flat file blogging engine from the FlatPress open source. A security vulnerability exists in FlatPress version 1.3.1, which stems from the presence of cross-site scripting in the administration area, which could lead to cross-site scripting attacks...

CVE-2025-29602

flatpress 1.3.1 is vulnerable to Cross Site Scripting XSS in Administration area via Manage categories...

CVE-2025-29602

Summary: CVE-2025-29602 affects FlatPress 1.3.1 with a stored XSS in the Administration area (Manage categories). The root cause is untrusted input handling in category management, enabling a payload stored by an admin that could affect other users. The vulnerability has a confirmed exploit refer...

Fake SSA Emails Trick Users into Installing ScreenConnect RAT

Cybercriminals are using fake Social Security Administration emails to distribute the ScreenConnect RAT Remote Access Trojan and compromise…...

Chat App Used by Trump Admin Suspends Operation Amid Hack

TM SGNL, a chat app by US-Israeli firm TeleMessage used by Trump officials, halts operations after a breach…...

CVE-2024-51991

October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...

The vulnerability of the /admin/chart1.php file of the attendance tracking management system, related to the failure to protect the SQL query structure, allows a perpetrator to execute arbitrary code.

The vulnerability of the /admin/chart1.php file of the attendance tracking management system involves a lack of measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...