ComicForm and SectorJ149 Hackers Deploy Formbook Malware in Eurasian Cyberattacks

Organizations in Belarus, Kazakhstan, and Russia have emerged as the target of a phishing campaign undertaken by a previously undocumented hacking group called ComicForm since at least April 2025. The activity primarily targeted industrial, financial, tourism, biotechnology, research, and trade...

PT-2025-38798

Name of the Vulnerable Software and Affected Versions e-plugins Directory Pro versions through 2.5.5 Description The software contains a flaw related to improper input handling during web page generation, leading to a DOM-Based Cross-site Scripting issue. This allows for potential malicious code...

CVE-2025-57948: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e-plugins Directory Pro directory-pro allows DOM-Based XSS.This issue affects Directory Pro: from n/a through = 2.5.5...

CVE-2025-57441: Exposure of Sensitive Information to an Unauthorized Actor

The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port 9990. Upon connection, the attacker can access a protocol preamble that leaks the video mode, routing configuration, input/output labels, device model, and...

CVE-2025-58014: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through = 6.7.0.64...

CVE-2025-57441

The Blackmagic ATEM Mini Pro 2.7 is vulnerable to an information disclosure flaw because an unauthenticated Telnet service on port 9990 exposes sensitive device and stream configuration details. By connecting to this service, an attacker can access a protocol preamble that leaks video mode , rout...

WordPress plugin Ays Pro Poll Maker has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A cross-site...

WordPress Plugin Directory Pro Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

Blackmagic Design ATEM Mini Pro security vulnerability

Blackmagic Design ATEM Mini Pro is a live video streaming device from Blackmagic Design, Inc. A security vulnerability exists in the Blackmagic Design ATEM Mini Pro version 2.7 that originates from an unauthenticated Telnet service exposing sensitive device information, which could lead to...

CVE-2025-57441

The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port 9990. Upon connection, the attacker can access a protocol preamble that leaks the video mode, routing configuration, input/output labels, device model, and...

CVE-2025-58015: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Data.This issue affects Quiz Maker: from n/a through = 6.7.0.65...

CVE-2025-57441

The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port 9990. Upon connection, the attacker can access a protocol preamble that leaks the video mode, routing configuration, input/output labels, device model, and...

PT-2025-38865

Name of the Vulnerable Software and Affected Versions Ays Pro Quiz Maker versions through 6.7.0.61 Description A flaw exists in Ays Pro Quiz Maker that could allow unauthorized retrieval of embedded sensitive data. The issue involves exposure of sensitive system information to an unauthorized...

CVE-2025-57954: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Poll Maker poll-maker allows DOM-Based XSS.This issue affects Poll Maker: from n/a through = 6.0.2...

PT-2025-38797

Name of the Vulnerable Software and Affected Versions Ays Pro Photo Gallery by Ays versions through 6.3.6 Description The software contains a flaw related to improper input handling during web page creation, leading to a DOM-Based Cross-site Scripting issue. This allows for the injection of...

Blackmagic Design ATEM Mini Pro security vulnerability

Blackmagic Design ATEM Mini Pro is a live video streaming device from Blackmagic Design, USA. A security vulnerability exists in the Blackmagic Design ATEM Mini Pro version 2.7 that originates from an undocumented Telnet service accepting unauthenticated commands in clear text, which could allow ...

CVE-2025-57440: Uncontrolled Resource Consumption

The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaming, recording, formatting storage devices, and system reboot. This interface, referred to as the "ATEM Ethernet Protocol 1.0", provides...

CVE-2025-34195

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 Windows client deployments contain a remote code execution vulnerability during driver installation caused by unquoted program paths. The PrinterInstallerClient driver-installati...

Exploit for CVE-2025-61546

vulnerability-disclosures Public disclosures of software vulne...

CVE-2025-34195

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 Windows client deployments contain a remote code execution vulnerability during driver installation caused by unquoted program paths. The PrinterInstallerClient driver-installati...