PT-2025-48656

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

WordPress VikRentCar Car Rental Management System plugin <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parameter vulnerability

Authenticated Author+ SQL Injection via 'month' Parameter vulnerability discovered by zhenhua fan in WordPress Plugin VikRentCar versions = 1.4.4...

Malicious code in month_year_dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d30f8bd0beed9617d4eaeb8717a7dfcbe805a095a59966041e4af31d174f9d2 The package monthyeardropdown was found to contain malicious code...

MAL-2025-49287 Malicious code in month_year_dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d30f8bd0beed9617d4eaeb8717a7dfcbe805a095a59966041e4af31d174f9d2 The package monthyeardropdown was found to contain malicious code...

EUVD-2025-37277

Malicious code in monthyeardropdown npm...

Trick, treat, repeat

Welcome to this week's edition of the Threat Source newsletter. This one is pretty much an updated, Halloween-themed version of my newsletter from July, including data up through Q3. October 14th has passed, so free support for Windows 10 has come to an end, leaving you with no more fixes unless...

Moving Beyond Awareness: How Threat Hunting Builds Readiness

Every October brings a familiar rhythm - pumpkin-spice everything in stores and cafés, alongside a wave of reminders, webinars, and checklists in my inbox. Halloween may be just around the corner, yet for those of us in cybersecurity, Security Awareness Month is the true seasonal milestone. Make ...

Moving Beyond Awareness: How Threat Hunting Builds Readiness

Every October brings a familiar rhythm - pumpkin-spice everything in stores and cafés, alongside a wave of reminders, webinars, and checklists in my inbox. Halloween may be just around the corner, yet for those of us in cybersecurity, Security Awareness Month is the true seasonal milestone. Make ...

PT-2025-41412

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT...

EUVD-2019-6729

Malware in sbrugna...

EUVD-2009-3065

Malware in sbrugna...

EUVD-2005-0294

Malware in sbrugna...

EUVD-2006-0787

Malware in sbrugna...

EUVD-2006-0260

Malware in sbrugna...

EUVD-2017-14725

Malware in sbrugna...

EUVD-2022-52657

Malicious code in bioql PyPI...

EUVD-2025-26160

Malicious code in bioql PyPI...

EUVD-2022-39391

Malicious code in bioql PyPI...

EUVD-2025-26190

Malicious code in bioql PyPI...

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

...