Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability

Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally...

Microsoft Windows Hardware Lab Kit 信任管理问题漏洞

Microsoft Windows Hardware Lab Kit is a test framework from Microsoft Corporation USA used to verify the compatibility of hardware devices and drivers with the Windows operating system. A trust management issue vulnerability exists in Microsoft Windows Hardware Lab Kit. An attacker could exploit...

KLA83574 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Microsoft Azure File Sync can be exploited remotely to gain privileges. 2. An...

WordPress Security Research Series: Setting Up Your Research Lab

Welcome to Part 3 of the WordPress Security Research Beginner Series! If you haven’t yet, take a minute to check out the series introduction to get a sense of what this series is all about. You’ll also want to catch up on Part 1, where we dig into WordPress request architecture and hooks, and Par...

China Hackers Used Trojanized UyghurEditPP App to Target Uyghur Activists

China-linked hackers targeted Uyghur activists using a Trojanized UyghurEditPP app in a spear-phishing campaign, Citizen Lab researchers reveal.…...

CVE-2025-39574

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Stored XSS.This issue affects Uix Shortcodes: from n/a through = 2.0.4...

GHSA-H9W6-F932-GQ62 ses's global contour bindings leak into Compartment lexical scope

Impact Web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used const, let, and class bindings in the top-level scope of a tag will have inadvertently revealed these bindings in the lexical scope...

CVE-2025-39574

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Stored XSS.This issue affects Uix Shortcodes: from n/a through = 2.0.4...

CVE-2025-39574

CVE-2025-39574 describes a stored XSS in UIUX Lab Uix Shortcodes caused by improper input neutralization during web page generation. Affected: Uix Shortcodes versions

PT-2025-16602 · Uiux · Uiux Lab Uix Shortcodes

Name of the Vulnerable Software and Affected Versions: UIUX Lab Uix Shortcodes versions n/a through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

How to Leak to a Journalist

Neiman Lab has some good advice on how to leak a story to a journalist...

Exploit for Code Injection in Craftcms Craft_Cms

craft-cms-RCE-CVE-2024-56145 A POC lab environment for CVE-202...

WordPress Query Wrangler plugin <= 1.5.54 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Query Wrangler versions = 1.5.54...

CVE-2024-53679 Apache VCL: XSS vulnerability in User Lookup impacting user privileges

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevate...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

It is an offensive tool for web application exploitation. The re...

Israeli Spyware Graphite Targeted WhatsApp with 0-Click Exploit

Citizen Lab's investigation reveals sophisticated spyware attacks exploiting WhatsApp vulnerabilities, implicating Paragon Solutions. Learn how their research exposed these threats and the implications for digital privacy...

lab-worldwide.com Cross Site Scripting vulnerability OBB-4038228

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

One of the most notorious providers of abuse-friendly "bulletproof" web hosting for cybercriminals has started routing its operations through networks run by the Russian antivirus and security firm Kaspersky Lab , KrebsOnSecurity has learned. Security experts say the Russia-based service provider...

CVE-2025-25206 Incorrect input validation could allow an authenticated user to read sensitive information

eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if...

CVE-2025-24616

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through = 1.7.3...