PerfreeBlog 安全漏洞

PerfreeBlog is PerfreeBlog open source, a java-based blog/CMS builder. A security vulnerability exists in PerfreeBlog version 4.0.11, which stems from a lack of authorization checking in the uploadAttachByUrl API endpoint, which could lead to server-side request forgery...

CVE-2025-61118

The CVE-2025-61118 entry concerns the mCarFix Motorists App (version 2.3, package com.skytop.mcarfix). Reports across multiple sources describe improper access control that enables bypassing verification to register accounts and, by manipulating sequential numeric IDs, unauthorized access to user...

CVE-2025-61121

CVE-2025-61121 affects Mobile Scanner Android App v2.12.38 (package com.glority.everlens) by Glority Global Group Ltd. The connected sources describe a credential leakage vulnerability caused by improper handling of cloud service credentials. Exploitation could lead to disclosure of sensitive inf...

CVE-2025-61118

mCarFix Motorists App version 2.3 package name com.skytop.mcarfix, developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers may bypass verification to arbitrarily register accounts, and by tampering with sequential numeric IDs, gain unauthorized access to user data...

Zucchetti Ad Hoc Revolution 安全漏洞

Zucchetti Ad Hoc Revolution is a business data processing system from Zucchetti, Italy. A security vulnerability exists in Zucchetti Ad Hoc Revolution 4.1 and earlier versions, which stems from an unvalidated pHtmlSource parameter that could lead to a cross-site scripting attack...

CVE-2025-61115

ABC Fine Wine & Spirits Android App version v.11.27.5 and before package name com.cta.abcfinewineandspirits, developed by ABC Liquors, Inc., contains an improper access control vulnerability in its login mechanism. The application does not properly validate user passwords during authentication,...

CVE-2025-61116

AdForest - Classified Android App version 4.0.12 package name scriptsbundle.adforest, developed by Muhammad Jawad Arshad, contains an improper access control vulnerability in its authentication mechanism. The app uses a Base64-encoded email address as the authorization credential, which can be...

CVE-2025-61114

2nd Line Android App version v1.2.92 and before package name com.mysecondline.app, developed by AutoBizLine, Inc., contains an improper access control vulnerability in its authentication mechanism. The server only validates the first character of the usertoken, enabling attackers to brute force...

PT-2025-44421

Name of the Vulnerable Software and Affected Versions AdForest - Classified Android App version 4.0.12 Description The AdForest - Classified Android App has an issue with how it controls access during authentication. The application utilizes a Base64-encoded email address as an authorization...

Malicious code in ais-sn-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2dae2da223bd605098cfd095d8e5adea72f0262e1c387f483fe9048a17215e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Gmail breach panic? It’s a misunderstanding, not a hack

After a misinterpretation of an interview with a security researcher, several media outlets hinted at a major Gmail breach. Reporters claimed the incident took place in April. In reality, the researcher had said there was an enormous amount of Gmail usernames and passwords circulating on the dark...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab versions 17.1 through before 18.3.5,...

WAVLINK QUANTUM D3G和WAVLINK WL-WN530HG3 安全漏洞

WAVLINK QUANTUM D3G and WAVLINK WL-WN530HG3 are both products of China RuiYin WAVLINK company.WAVLINK QUANTUM D3G is a router.WAVLINK WL-WN530HG3 is a WiFi router. A security vulnerability exists in the WAVLINK QUANTUM D3G and WAVLINK WL-WN530HG3 that originates from a stack-based buffer overflow...

⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens

Security, trust, and stability — once the pillars of our digital world — are now the tools attackers turn against us. From stolen accounts to fake job offers, cybercriminals keep finding new ways to exploit both system flaws and human behavior. Each new breach proves a harsh truth: in...

BeWelcome 安全漏洞

BeWelcome is a travel sharing site open-sourced by BeWelcome. BeWelcome has a security vulnerability that stems from improper handling of deserialization of the POST parameters formkitmemoryrecovery and memory cookie bwRemember, which could lead to a PHP object injection attack...

Perx Customer Engagement & Loyalty Platform 安全漏洞

Perx Customer Engagement & Loyalty Platform is a customer engagement campaign platform from Perx Singapore. A security vulnerability exists in Perx Customer Engagement & Loyalty Platform versions prior to 4.617.4, which stems from improperly cleaned SVG file uploads and could lead to a stored...

InventoryGui 安全漏洞

InventoryGui is a plugin library from the individual developer Max Lee. A security vulnerability exists in InventoryGui 1.6.1-SNAPSHOT and prior versions, which stems from a vulnerability that may allow item duplication when using GuiStorageElement...

SICK AG TLOC100-100 安全漏洞

The SICK AG TLOC100-100 is a mobile robot positioning system from SICK Germany. A security vulnerability exists in the SICK AG TLOC100-100 that stems from an attacker's access to a non-privileged account via SSH could result in a service interruption, causing a loss of persistent availability...

Wimi Teamwork 安全漏洞

Wimi Teamwork is a team collaboration cloud platform from Wimi USA. A security vulnerability exists in Wimi Teamwork versions prior to 7.38.17 that stems from the API not validating the csrftoken field value, which could lead to a cross-site request forgery attack...

HubSpot 安全漏洞

HubSpot is a customer relationship management platform in the United States. A security vulnerability exists in HubSpot version v1.29441, which stems from improper access control of REST API endpoints and could lead to unauthorized viewing of user data...