CVE-2025-57145

CVE-2025-57145 concerns an XSS in the ATSMS web application, specifically the search-autootaxi.php endpoint. The issue arises from improper sanitization of form input, allowing a attacker-supplied JavaScript payload to be stored in the backend and executed when an affected report page is viewed. ...

CVE-2025-30075

CVE-2025-30075 affects Alludo MindManager on Windows prior to 25.0.208. An attacker who can write DLL files to directories within the victim’s DLL search paths could achieve code execution as a local user. Root cause is DLL writing in search paths enabling arbitrary code execution under local pri...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

Ubuntu 24.04 LTS / 25.04 : SQLite vulnerability (USN-7751-1)

The remote Ubuntu 24.04 LTS / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7751-1 advisory. It was discovered that the FTS5 SQLite extension incorrectly calculated certain array lengths. An attacker could use this issue to cause SQLite to crash,...

XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution (RCE)

Exploit Title: XWiki Platform 15.10.10 - Metasploit Module for Remote Code Execution RCE Date: 09/01/2025 Exploit Author: Maksim Rogov Vendor Homepage: https://www.xwiki.org/ Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: 5.3‑milestone‑2 ≤ v 'Remote Code Execution...

CVE-2025-10448

A flaw has been found in Campcodes Online Job Finder System 1.0. This affects an unknown function of the file /index.php?q=result&searchfor=bycompany. This manipulation of the argument Search causes sql injection. The attack can be initiated remotely. The exploit has been published and may be use...

CVE-2025-10448

CVE-2025-10448 affects Campcodes Online Job Finder System 1.0. The vulnerability is an SQL injection in the parameter manipulated through /index.php?q=result&searchfor=bycompany, exploitable remotely. Multiple sources confirm exploitation potential and that an exploit has been published. Some fee...

CVE-2025-10448 Campcodes Online Job Finder System index.php sql injection

A flaw has been found in Campcodes Online Job Finder System 1.0. This affects an unknown function of the file /index.php?q=result&searchfor=bycompany. This manipulation of the argument Search causes sql injection. The attack can be initiated remotely. The exploit has been published and may be use...

CVE-2025-10446

A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custsearchfrm.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely...

CVE-2025-10446 Campcodes Computer Sales and Inventory System cust_searchfrm.php sql injection

A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custsearchfrm.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely...

CVE-2025-10446 Campcodes Computer Sales and Inventory System cust_searchfrm.php sql injection

A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custsearchfrm.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely...

CVE-2025-10446

CVE-2025-10446 affects Campcodes Computer Sales and Inventory System 1.0. The vulnerability is an SQL injection in an unknown function of the file /pages/cust_searchfrm.php?action=edit, triggered by manipulating the ID parameter. Exploitation can be conducted remotely and the exploit has been pub...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks

Chinese-speaking users are the target of a search engine optimization SEO poisoning campaign that uses fake software sites to distribute malware. "The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites," Fortinet...

A Practical Adversarial Attack against Sequence-Based Deep Learning Malware Classifiers

Sequence-based deep learning models e.g., RNNs, can detect malware by analyzing its behavioral sequences. Meanwhile, these models are susceptible to adversarial attacks. Attackers can create adversarial samples that alter the sequence characteristics of behavior sequences to deceive malware...

PT-2025-37563

Name of the Vulnerable Software and Affected Versions: Campcodes Online Job Finder System version 1.0 Description: A flaw has been found that allows for SQL injection. The issue affects an unknown function of the file /index.php?q=result=bycompany. Manipulation of the Search parameter causes the...

LOKI: Proactively Discovering Online Scam Websites by Mining Toxic Search Queries

Online e-commerce scams, ranging from shopping scams to pet scams, globally cause millions of dollars in financial damage every year. In response, the security community has developed highly accurate detection systems able to determine if a website is fraudulent. However, finding candidate scam...

PT-2025-37477

Name of the Vulnerable Software and Affected Versions: Campcodes Online Job Finder System version 1.0 Description: A security flaw exists in Campcodes Online Job Finder System that allows for SQL injection. The issue affects the processing of the /advancesearch.php file. Manipulation of the...

CVE-2025-10330

A flaw has been found in cdevroe unmark up to 1.9.3. This vulnerability affects unknown code of the file application/views/layouts/topbar/searchform.php. This manipulation of the argument q causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published...

SCANNER-INURLBR

This is an offensive tool for web application vulnerability scanning. The tool, INURLBR, is designed to perform advanced searches in search engines to exploit GET/POST capturing emails and URLs, with an internal custom validation junction for each target/URL found. It is written in PHP and can ru...