Exploiting API4 — 8 Real-World Unrestricted Resource Consumption Attack Scenarios (and How to Stop Them)

Unrestricted Resource ConsumptionAPI4:2023 is the only threat category in the OWASP API Security Top 10 explicitly dedicated to Denial of Service DoS and resource abuse. But despite being just one category, attackers can exploit it in many different ways; from large file uploads and expensive...

Police Bust Crypto Scammers, Nab Smishing SMS Blaster Operator

Thai police arrest SMS Blaster operator in smishing scam and bust crypto laundering gang moving $30M monthly through…...

WordPress SMS Alert Order Notifications plugin <= 3.8.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by ChuongVN in WordPress Plugin SMS Alert Order Notifications versions = 3.8.5...

New warning issued over toll fee scams

Over a year ago the FBI warned about what was then a new form of smishing phishing via SMS scam: text messages that demanded payment for toll fees. The FTC sent out a similar warning in January, 2025. Then, in April another wave of toll fee scams began doing the rounds. Now the Departments of Mot...

CVE-2023-30321

Cross Site Scripting XSS vulnerability in textMessage field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code...

CVE-2021-20071

Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs...

CVE-2018-14991

The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of...

CVE-2019-15346

The Tecno Camon iClick 2 Android device with a build fingerprint of TECNO/H622/TECNO-ID6:8.1.0/O11019/F-180824V116:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

Smishing Triad: The Scam Group Stealing the World’s Riches

Millions of scam text messages are sent every month. The Chinese cybercriminals behind many of them are expanding their operations—and quickly innovating...

PT-2025-14091 · WordPress · Sms Alert Order Notifications

Name of the Vulnerable Software and Affected Versions: SMS Alert Order Notifications – WooCommerce plugin for WordPress versions up to, and including, 3.7.9 Description: The issue allows for privilege escalation via account takeover. This is due to the plugin using the Host header to determine if...

Astra Linux – Vulnerability in Zabbix

Setting the SMS media allows for setting the GSM modem file. This file is later used as a Linux device. But since everything is a file for Linux, it’s possible to set another file, such as a log file. In this case, Zabbixserver will attempt to communicate with it as a modem. As a result, the log...

ZTE MF296R 安全漏洞

The ZTE MF296R is a wireless router from ZTE Corporation ZTE of China. A security vulnerability exists in the ZTE MF296R that stems from insufficient validation of the length of SMS parameters, which could be exploited by an authenticated attacker to perform a denial of service attack...

How to avoid election related scams

With the US election campaigns at full throttle, scammers have taken a renewed interest in the ways this can be used to defraud people, often using the same tactics legitimate campaigns leverage for support emails, text messages, phone calls, and social media pleas. The lure that we have seen the...

WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peng Zhou Patchstack Alliance in WordPress Plugin WP SMS versions = 6.9.3...

Zabbix 安全漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in Zabbix versions 5.0.42, 6.0.30, 6.4.15, and 7.0.0rc2, which stems from the presence of an AT GSM comma...

SUSE CVE-2024-7537

oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

PT-2024-38407

Name of the Vulnerable Software and Affected Versions oFono affected versions not specified Description This issue allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to...

Bypassing 2FA with phishing and OTP bots

Introduction Two-factor authentication 2FA is a security feature we have come to expect as standard by 2024. Most of todays websites offer some form of it, and some of them wont even let you use their service until you enable 2FA. Individual countries have adopted laws that require certain types ...

The vulnerability of the decode_deliver_report() function in the OFono mobile phone stack allows a hacker to execute arbitrary code.

The vulnerability of the decodedeliverreport function in the OFono mobile phone stack is related to the execution of an operation outside the buffer in memory when sending SMS messages in the PDU format. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the User Plane Location (SUPL) message handler in the Telit Cinterion modem software allows a perpetrator to execute arbitrary code.

The vulnerability of the User Plane Location SUPL message handler in Telit Cinterion modem software is related to buffer overflow attacks. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted SMS message...