U.S. Dept Of Defense: Sensitive Images & Files Exposed Through Directory Listing

During reconnaissance, a directory listing was identified that provided an index of resources located inside the directory. The specific files exposed were not provided. The affected system host was not disclosed...

TVs at HUD Played an AI-Generated Video of Donald Trump Kissing Elon Musk’s Feet

On Monday morning, TV sets at the headquarters of the Department of Housing and Urban Development played the seemingly AI-generated video on loop, along with the words “LONG LIVE THE REAL KING.”...

Trump 2.0 Brings Cuts to Cyber, Consumer Protections

One month into his second term, President Trump's actions to shrink the government through mass layoffs, firings and withholding funds allocated by Congress have thrown federal cybersecurity and consumer protection programs into disarray. At the same time, agencies are battling an ongoing effort ...

CVE-2025-1591

A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /department.php of the component Department Page. The manipulation of the argument Department Name leads to cross...

CVE-2025-1591

A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /department.php of the component Department Page. The manipulation of the argument Department Name leads to cross...

CVE-2025-1591

CVE-2025-1591 affects SourceCodester Employee Management System 1.0, specifically the Department Page component. The vulnerability resides in /department.php where manipulating the Department Name parameter leads to cross-site scripting. The attack is described as remote. Connected sources corrob...

CVE-2025-1591 SourceCodester Employee Management System Department Page department.php cross site scripting

A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /department.php of the component Department Page. The manipulation of the argument Department Name leads to cross...

U.S. Dept Of Defense: Exposed Sensitive PDF: Misconfigured Access Controls Leading to Information Disclosure

A sensitive PDF document marked "UNCLASSIFIED // NOT APPROVED FOR PUBLIC RELEASE // FOR OFFICIAL USE ONLY" was found to be publicly accessible on the ACC website due to a misconfigured access control. This resulted in an unintended disclosure of internal information...

PT-2025-7688 · Sourcecodester · Sourcecodester Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee Management System version 1.0 Description: A vulnerability was found in the Department Page component, specifically in the file /department.php. The issue arises from the manipulation of the Department Name argument,...

SourceCodester Employee Management System 代码注入漏洞

SourceCodester Employee Management System is SourceCodester open source a php-based for employee performance management system . A code injection vulnerability exists in version 1.0 of the SourceCodester Employee Management System, which originates from cross-site scripting due to incorrect...

CVE-2025-26158

A Stored Cross-Site Scripting XSS vulnerability was discovered in the manage-employee.php page of Kashipara Online Attendance Management System V1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the department parameter...

PT-2025-7127 · Unknown · Kashipara Online Attendance Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Online Attendance Management System version V1.0 Description: A Stored Cross-Site Scripting XSS issue was found in the manage-employee.php page, allowing remote attackers to execute arbitrary scripts via the department parameter...

Kashipara Online Attendance Management System 安全漏洞

Kashipara Online Attendance Management System is an online attendance management system from Kashipara open source. A security vulnerability exists in Kashipara Online Attendance Management System version V1.0, which stems from a stored cross-site scripting XSS vulnerability that allows remote...

DOGE as a National Cyberattack

In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history--not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the...

CVE-2024-54954

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department...

US Funding Cuts Are Helping Criminals Get Away With Child Abuse and Human Trafficking

Services supporting victims of online child exploitation and trafficking around the world have faced USAID and State Department cuts—and children are suffering as a result, sources tell WIRED...

The Collapse of USAID Is Already Fueling Human Trafficking and Slavery at Scammer Compounds

The dismantling of USAID by Elon Musk's DOGE and a State Department funding freeze have severely disrupted efforts to help people escape forced labor camps run by criminal scammers...

BeyondTrust Zero-Day Breach Exposed 17 SaaS Customers via Compromised API Key

BeyondTrust has revealed it completed an investigation into a recent cybersecurity incident that targeted some of the company's Remote Support SaaS instances by making use of a compromised API key. The company said the breach involved 17 Remote Support SaaS customers and that the API key was used...

U.S. Dept Of Defense: Air Force candidate PII + recruitment chat logs accessible via BAC/IDOR on █████████ (very large/significant exposure)

A vulnerability was discovered in a Department of Defense-owned Salesforce asset that allowed unauthorized access to sensitive personal information of Air Force candidates. The vulnerability stemmed from a misconfiguration in the Document object, which permitted an attacker to retrieve a large...

U.S. Dept Of Defense: IDOR Exposes PII of Tens of Thousands of Users and Supervisors

A vulnerability was discovered that exposed personally identifiable information PII of tens of thousands of users and supervisors. The vulnerability was found in a system that allowed users to submit a SAAR. By modifying a URL parameter, users could view other users' SAARs, which contained...