CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897

GLPI planning feature vulnerability: versions 9.1.0–10.0.18 allow unauthenticated users to send a malicious link to conduct phishing. Root cause described in multiple sources as inadequate filtering/handling of links within the planning module (with some references labeling it as XSS and open red...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

Keycloak phishing attack via email verification step in first login flow

There is a flaw with the first login flow where, during a IdP login, an attacker with a registered account can initiate the process to merge accounts with an existing victim's account. The attacker will subsequently be prompted to "review profile" information, which allows the the attacker to...

GLPI 安全漏洞

GLPI is a free asset and IT management software suite. A phishing attack vulnerability exists in GLPI versions 9.1.0 through 10.0.18, which stems from a planning feature that does not effectively filter malicious links sent by unauthenticated users. An attacker could use this vulnerability to...

PT-2025-31385 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.1.0 through 10.0.18 Description: GLPI is an Asset and IT Management Software package. An unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. Recommendations: Update to version...

PyPI Warns of Ongoing Phishing Campaign Using Fake Verification Emails and Lookalike Domain

The maintainers of the Python Package Index PyPI repository have issued a warning about an ongoing phishing attack that's targeting users in an attempt to redirect them to fake PyPI sites. The attack involves sending email messages bearing the subject line "PyPI Email verification" that are sent...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.6 Images Security Update

New images are available for Red Hat build of Keycloak 26.2.6 and Red Hat build of Keycloak 26.2.6 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.6 Security Update

New Red Hat build of Keycloak 26.2.6 packages are available from the Customer Portal Red Hat build of Keycloak 26.2.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...

keycloak: Phishing attack via email verification step in first login flow

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.13 Update

New Red Hat build of Keycloak 26.0.13 packages are available from the Customer Portal Red Hat build of Keycloak 26.0.13 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

Phishers Target Aviation Execs to Scam Customers

KrebsOnSecurity recently heard from a reader whose boss's email account got phished and was used to trick one of the company's customers into sending a large payment to scammers. An investigation into the attacker's infrastructure points to a long-running Nigerian cybercrime ring that is actively...

CVE-2025-51862

Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...

WordPress Invico-WordPress Consulting Business Theme Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Invico-WordPress Consulting Business Theme, which stems from improper handling of inputs during web page generation...

CVE-2025-51862

Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...

CVE-2025-51862

Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...

Fake npm Website Used to Push Malware via Stolen Token

Fake npm website used in phishing attack to steal maintainer token, leading to malware in popular JavaScript packages like eslint-config-prettier...

CVE-2025-54066 DiracX-Web login page has Open Redirect vulnerability

DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a redirect field which i...

CVE-2025-54066

DiracX-Web has an Open Redirect vulnerability in versions prior to 0.1.0-a8. The login page’s redirect field accepts an arbitrary URI and is not validated. When combined with parameter pollution, an attacker can cloak a malicious redirect, potentially phishing users and harvesting credentials. Th...

WordPress plugin Image Wall 跨站脚本漏洞

WordPress Image Wall is a WordPress plugin that allows users to browse blog posts or page content via images. WordPress Image Wall suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be exploited by an attacker to execute a phishing attack by...