MAL-2025-191003 Malicious code in react-native-phone-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e134ec88971e1ecadce79d1699bde00b798633b1ef9a0f6ebb2dbf67a51cdf5 The package react-native-phone-call was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199040

Malicious code in react-native-phone-call npm...

CVE-2025-12878

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfopphone shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied default...

EUVD-2025-198104

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfopphone shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied default...

CVE-2025-12878

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfopphone shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied default...

CVE-2025-12878 FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfopphone shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied default...

CVE-2025-12878

The FunnelKit – Funnel Builder for WooCommerce Checkout WordPress plugin is affected by a stored XSS via the wfop_phone shortcode, in all versions up to and including 3.13.1.2. Exploitation requires authenticated access at Contributor+ level, due to insufficient input sanitization and output esca...

PT-2025-47436

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfop phone shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied default...

A Simple WhatsApp Security Flaw Exposed 3.5 Billion Phone Numbers

By plugging tens of billions of phone numbers into WhatsApp’s contact discovery tool, researchers found “the most extensive exposure of phone numbers” ever—along with profile photos and more...

EUVD-2024-55078

Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These include: c-full, fname, mname,lname, gname, ocp, nation, mobno, email, board1, roll1, pyear1, board2, roll2, pyear2, sub1,marks1, sub2, course-short, income, category, ph, country,...

CLSA-2025-1763031616 bluez: Fix of 10 CVEs

CVE-2023-27349: fix crash while handling unsupported events in avrcp - CVE-2023-44431: fix Stack-based buffer overflow and remote code execution vulnerability - CVE-2023-45866: restrict HID connections to avoid unauthorized input injection - CVE-2023-50229: fix heap-based buffer overflow...

CVE-2025-12928

A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument username/phone results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and ma...

CVE-2025-12928

A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument username/phone results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and ma...

PT-2025-45595

Name of the Vulnerable Software and Affected Versions code-projects Online Job Search Engine version 1.0 Description A SQL injection issue exists in code-projects Online Job Search Engine version 1.0. The issue affects an unknown function within the /login.php file. Manipulation of the...

Code-Projects Online Job Search Engine SQL注入漏洞

Code-Projects Online Job Search Engine is an online job search engine from Code-Projects. A SQL injection vulnerability exists in Code-Projects Online Job Search Engine version 1.0, which stems from incorrect manipulation of the username/phone parameter in the file /login.php, which could lead to...

CBP Searched a Record Number of Phones at the US Border Over the Past Year

The total number of US Customs and Border Protection device searches jumped by 17 percent over the 2024 fiscal year, but more invasive forensic searches remain relatively rare...

First Wap: A Surveillance Computer You’ve Never Heard Of

Mother Jones has a long article on surveillance arms manufacturers, their wares, and how they avoid export control laws: Operating from their base in Jakarta, where permissive export laws have allowed their surveillance business to flourish, First Wap's European founders and executives have quiet...

Cisco Desk/IP/Video Phone Denial of Service (cisco-sa-phone-dos-FPyjLV7A) (CVE-2025-20350)

According to its self-reported version, the remote Cisco Desk, IP, or Video Phone running SIP Software is affected by a denial of service vulnerability: - A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco S...

Chinese gangs made over $1 billion targeting Americans with scam texts

We regularly warn our readers about new scams and phishing texts. Almost everyone gets pestered with these messages. But where are all these scam texts coming from? According to an article in The Wall Street Journal: “It has become a billion-dollar, highly sophisticated business benefiting...

CVE-2025-11946 LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting

A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site...