CVE-2025-12456

CVE-2025-12456 affects the WordPress plugin Centangle-Team Showcase (Centangle-Team). Public sources confirm a Cross-Site Request Forgery vulnerability in versions up to 1.0.0 due to missing or incorrect nonce validation, enabling unauthenticated attackers to modify plugin settings by tricking an...

LLM Agents for Automated Web Vulnerability Reproduction: Are We There Yet?

Large language model LLM agents have demonstrated remarkable capabilities in software engineering and cybersecurity tasks, including code generation, vulnerability discovery, and automated testing. One critical but underexplored application is automated web vulnerability reproduction, which...

caifinancial.ca Cross Site Scripting vulnerability OBB-3336916

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

cai-x.com Cross Site Scripting vulnerability OBB-2958452

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SQL Injection Vulnerability in the Website Building System of Shanghai Cai Sheng Information Technology Co.

Shanghai Cai Sheng Information Technology Co., Ltd abbreviated as: "Cai Sheng Planning" was founded in 2005, is a digital marketing as the core of the integrated marketing services company. There is a SQL injection vulnerability in the website building system of Shanghai CaiSheng Information...

SQL Injection Vulnerability in the Website Building System of Shanghai Cai Sheng Information Technology Co.

Shanghai Cai Sheng Information Technology Co., Ltd abbreviated as: "Cai Sheng Planning" was founded in 2005, is a digital marketing as the core of the integrated marketing services company. There is a SQL injection vulnerability in the website building system of Shanghai CaiSheng Information...

Command Execution Vulnerability in the PC Client of HuaxiaYunCai.com

Huaxia Cloud Finance PC Client is a financial management software. A command execution vulnerability exists in Huaxia Yun Cai Network PC Client. An attacker can exploit the vulnerability to execute arbitrary code...

SQL Injection Vulnerability in the Website Building System of Shanghai Cai Sheng Information Technology Co.

Shanghai Cai Sheng Information Technology Co., Ltd. is a company that focuses on enterprise website construction. Shanghai CaiSheng Information Technology Co., Ltd. website building system has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from...

China's Border Guards Secretly Installing Spyware App on Tourists' Phones

Chinese authorities are secretly installing surveillance apps on smartphones of foreigners at border crossings in the Xinjiang region who are entering from neighboring Kyrgyzstan, an international investigation revealed. Xinjiang XUAR is an autonomous territory and home to many Muslim ethnic...

RHEL 7 : kernel (RHSA-2017:1842)

"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1842 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: An use-after-free flaw was found in t...

China: 'We are ready for International cooperation to deal with cyber security Challenges'

Yesterday at Stanford University in the United States, Cyber Security Experts and Leaders from more than 40 countries gathered to talk about the cyberspace security problems and cooperation among countries. The need for international cooperation in cybersecurity is evident, due to the nature of...

IBM Lotus Notes code execution

Code injection via cai: URI is not fixed for more than year...

CVE-2011-0912

Argument injection vulnerability in IBM Lotus Notes 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5 allows remote attackers to execute arbitrary code via a cai:// URL containing a --launcher.library option that specifies a UNC share pathname for a DLL file, aka SPR PRAD82YJW2...

(0Day) IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes. User interaction is required to exploit this vulnerability. The specific flaw exists within the handling of malformed strings within cai:// URIs. The '--launcher.library' switch ca...

lotus-exec.txt

Hello, I have found that the lotus expeditor rcplauncher as installed by lotus symphony and possibly other products, registers a cai: uri handler. This handler executes "D:\Program Files\IBM\Lotus\Symphony\framework\rcp\rcplauncher.exe" -config notes -com.ibm.rcp.portal.app.uiopenCA "%1" the...