CVE-2023-38768

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php...

Judging Management System SQL注入漏洞

Judging Management System is a judging management system. Judging Management System v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the id parameter of /php-jms/deductScores.php. An attacker can exploit this vulnerabilit...

PT-2023-19574 · WordPress · I Thirteen Web Solution Wordpress Vertical Image Slider

Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution WordPress vertical image slider plugin versions prior to 1.2.17 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts...

Race Condition

gitlab is vulnerable to Race Condition. An attacker could exploit this vulnerability by tricking a GitLab user into visiting a malicious website. Once the user visits the malicious website, the attacker could exploit the vulnerability to forge a verified email and take over their third-party...

Improper Authorization

gitlab is vulnerable to Improper Authorization. An attacker could exploit this vulnerability to gain control of a GitLab project by importing members from another project that they control. This could allow the attacker to steal data, modify code, or delete the project...

Information Disclosure

firefox is vulnerable to Information Disclosure. An attacker could exploit this vulnerability by tricking a user into visiting a malicious website or by opening a malicious attachment. If the user is using a vulnerable version of Firefox, the attacker could execute arbitrary code on the user's...

Use-After-Free

firefox is vulnerable to Use-After-Free. An attacker could exploit this vulnerability by tricking a user into visiting a malicious website or by opening a malicious attachment. If the user is using a vulnerable version of Firefox, the attacker could execute arbitrary code on the user's system. Th...

Resort Reservation System SQL注入漏洞

Resort Reservation System is a resort reservation system. A SQL injection vulnerability exists in version 1.0 of the Resort Reservation System due to a lack of validation of externally entered SQL statements in the id parameter of the manageuser.php page. An attacker can use this vulnerability to...

Multiple Stored XSS Found

Description Stored XSS Cross-Site Scripting is a type of web security vulnerability caused by improper input validation and inadequate data sanitization in a web application. It occurs when an attacker injects malicious scripts usually in the form of HTML or JavaScript into a website's database o...

New Version of Rilide Data Theft Malware Adapts to Chrome Extension Manifest V3

Cybersecurity researchers have discovered a new version of malware called Rilide that targets Chromium-based web browsers to steal sensitive data and steal cryptocurrency. "It exhibits a higher level of sophistication through modular design, code obfuscation, adoption to the Chrome Extension...

Half-Year in Review: Recapping the top threats and security trends so far in 2023

From new ransomware groups, a growing mercenary space, espionage campaigns, supply chain attacks, and new "as a service" tools popping up, theres a lot to talk about already in the first half of 2023. Here are the main threats weve covered on our blog up until the end of June 2023. The timeline i...

Advantech iView SQL Injection Vulnerability (CNVD-2025-30967)

Advantech iView is a software developed by Advantech for managing B+BSmartWorx series devices through a simple network management protocol. Advantech iView suffers from a SQL injection vulnerability that originates from the application's lack of validation of externally entered SQL statements. An...

emlog SQL注入漏洞

emlog is a PHP and MySQL based CMS builder for emlog personal developers. A SQL injection vulnerability exists in emlog version 2.1.9, which stems from the lack of validation of externally entered SQL statements in the file /admin/user.php. An attacker can exploit this vulnerability to execute...

Multiple Flaws Found in Ninja Forms Plugin Leave 800,000 Sites Vulnerable

Multiple security vulnerabilities have been disclosed in the Ninja Forms plugin for WordPress that could be exploited by threat actors to escalate privileges and steal sensitive data. The flaws, tracked as CVE-2023-37979, CVE-2023-38386, and CVE-2023-38393, impact versions 3.6.25 and below,...

Art Gallery Management System SQL注入漏洞

Art Gallery Management System is an art gallery management system. An SQL injection vulnerability exists in Art Gallery Management System v1.0, which originates from the lack of validation of the parameter cid in /agms/product.php against external SQL input. An attacker can exploit this...

Advantech iView SQL注入漏洞

Advantech iView is a software developed by Advantech for managing B+BSmartWorx series devices through a simple network management protocol. Advantech iView suffers from a SQL injection vulnerability that originates from the application's lack of validation of externally entered SQL statements. An...

Iranian Stalkerware ‘Spyhide’ Steals Data from 60,000 Android Devices

By Habiba Rashid So far, Spyhide app collected 3.3 million texts and 1.2 million call logs from compromised Android devices. This is a post from HackRead.com Read the original post: Iranian Stalkerware Spyhide Steals Data from 60,000 Android Devices...

Fenix Botnet Preys on Mexico and Chile

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Fenix Botnet targets tax-paying individuals in Mexico and Chile, aiming to infiltrate specific networks and pilfer valuable data. To receive real-time threat advisories, please follow HiveForce Labs ...

Realst Infostealer Hides Behind Phony Blockchain Games

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Multiple counterfeit blockchain games are being exploited to infiltrate both Windows and macOS systems with a sophisticated infostealer developed in Rust, known as realst. This malicious software...

Incident Response trends Q2 2023: Data theft extortion rises, while healthcare is still most-targeted vertical

Cisco Talos Incident Response Talos IR responded to a growing number of data theft extortion incidents that did not involve encrypting files or deploying ransomware, a 25 percent increase since last quarter and the most-observed threat in the second quarter of 2023. In this type of attack, threat...