4039 matches found
Fake AI Tools Push New Noodlophile Stealer Through Facebook Ads
Scammers are using fake AI tools and Facebook ads to spread Noodlophile Stealer malware, targeting users with a…...
CVE-2025-47531: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through = 1.1.7...
New Investment Scams Use Facebook Ads, RDGA Domains, and IP Checks to Filter Victims
Cybersecurity researchers have lifted the lid on two threat actors that orchestrate investment scams through spoofed celebrity endorsements and conceal their activity through traffic distribution systems TDSes. The activity clusters have been codenamed Reckless Rabbit and Ruthless Rabbit by DNS...
Omise: Facebook Username Takeover via Broken Link in Footer
The Facebook username associated with the broken link in the footer was available for takeover. This could have allowed an attacker to create a fake Facebook page and mislead users into trusting it...
I Know What You Bought Last Summer: Investigating User Data Leakage in E-Commerce Platforms
In the digital age, e-commerce has transformed the way consumers shop, offering convenience and accessibility. Nevertheless, concerns about the privacy and security of personal information shared on these platforms have risen. In this work, we investigate user privacy violations, noting the risks...
Facebook WhatsApp 安全漏洞
Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that are based on the Android platform and utilize the network to deliver text messages. The application uses contact information in a smartphone to find contacts using the software to send texts, pictures...
CVE-2025-32169: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suresh Prasad Showeblogin Social showeblogin-facebook-page-like-box allows DOM-Based XSS.This issue affects Showeblogin Social: from n/a through = 7.0...
Case Study: Are CSRF Tokens Sufficient in Preventing CSRF Attacks?
Explore how relying on CSRF tokens as a security measure against CSRF attacks is a recommended best practice, but in some cases, they are simply not enough. Introduction As per the Open Web Application Security Project OWASP, CSRF vulnerabilities are recognized as a significant threat and are...
CVE-2025-31433: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through = 3.1.2...
CVE-2025-25086: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through = 1.2.1...
CVE-2024-13772
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fbajaxloginorregister and googleajaxloginorregist...
CVE-2024-13772
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fbajaxloginorregister and googleajaxloginorregist...
WordPress plugin Civi 访问控制错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control...
PT-2025-11255
Name of the Vulnerable Software and Affected Versions: The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress versions up to, and including, 2.1.4 Description: The issue is due to a lack of randomization of a password created during Single Sign-On via Google or Facebook...
PT-2025-9165
Name of the Vulnerable Software and Affected Versions Alloggio Membership plugin for WordPress version 1.0.2 and earlier Description The issue is related to the plugin not properly validating a user's identity through the alloggio membership init rest api facebook login and alloggio membership in...
PT-2025-9166
Name of the Vulnerable Software and Affected Versions Academist Membership plugin for WordPress versions prior to 1.1.7 Description The issue is related to privilege escalation due to the academist membership check facebook user function not properly verifying a user's identity before...
CVE-2025-1638: Authentication Bypass Using an Alternate Path or Channel
The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggiomembershipinitrestapifacebooklogin and alloggiomembershipinitrestapigooglelogin...
CVE-2025-0769: Deserialization of Untrusted Data
PixelYourSite - Your smart PIXEL TAG and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php...
Inside the Telegram Groups Doxing Women for Their Facebook Posts
A WIRED investigation goes inside the Telegram groups targeting women who joined “Are We Dating the Same Guy?” groups on Facebook with doxing, harassment, and sharing of nonconsensual intimate images...