CVE-2025-12362

CVE-2025-12362 affects the WordPress plugin myCred – Points Management System (

PT-2025-51087

The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This mak...

EUVD-2025-203035

Malicious code in sd-pay npm...

MAL-2025-192563 Malicious code in sd-pay-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7543455a42022174e965eac8f842494f5ad7eb1e0755dfd01035529d63d7a5ff The package sd-pay-ts was found to contain malicious code. Source: ghsa-malware c21a3fe3b0a1df838e4d8b768b5dcc2cf3831bea34c8527fd9e8493ab480bdd7 Any...

Malicious Package

Overview sd-pay is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2025-192562 Malicious code in sd-pay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9616f3280e84767be7a4d7eb72057a907816c66dba6104915b31df22260c16f4 The package sd-pay was found to contain malicious code. Source: ghsa-malware a8a08228b2c2618675e777b8bd306f5499f39767b26a7e12deb1dc0ce91175b5 Any...

Malicious code in sd-pay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9616f3280e84767be7a4d7eb72057a907816c66dba6104915b31df22260c16f4 The package sd-pay was found to contain malicious code. Source: ghsa-malware a8a08228b2c2618675e777b8bd306f5499f39767b26a7e12deb1dc0ce91175b5 Any...

Malicious code in sd-pay-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7543455a42022174e965eac8f842494f5ad7eb1e0755dfd01035529d63d7a5ff The package sd-pay-ts was found to contain malicious code. Source: ghsa-malware c21a3fe3b0a1df838e4d8b768b5dcc2cf3831bea34c8527fd9e8493ab480bdd7 Any...

Malicious Package

Overview sd-pay-ts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

EUVD-2025-203044

Malicious code in sd-pay-ts npm...

The Dark Web Economy Behind Ad Fraud: What Marketers Don’t See

Ad fraud networks use bots, deepfakes and spoofed traffic to drain PPC budgets. This report shows how fake clicks distort performance data...

CVE-2025-57210

Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors...

CVE-2025-57210

Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors...

Scam USPS and E-Z Pass Texts and Websites

Google has filed a complaint in court that details the scam: In a complaint filed Wednesday, the tech giant accused "a cybercriminal group in China" of selling "phishing for dummies" kits. The kits help unsavvy fraudsters easily “execute a large-scale phishing campaign,” tricking hordes of...

Unspecified vulnerability in mall-swarm

mall-swarm is a microservice mall system. There is a security vulnerability in mall-swarm, which originates from the mishandling of the orderID parameter in the paySuccess function in the file /order/paySuccess, for which no detailed vulnerability details are available at this time...

PT-2025-46833

A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be...

CVE-2025-60784

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase...

CVE-2025-60784

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase...

CVE-2025-60784

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase...

PT-2025-45162

Name of the Vulnerable Software and Affected Versions XiaozhangBang Voluntary Like System version 8.8 Description A flaw exists in the XiaozhangBang Voluntary Like System version 8.8 that allows remote attackers to manipulate the zhekou parameter within the /topfirst.php Pay module. By sending a...