CVE-2025-62261

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to...

CVE-2025-62261

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to...

CVE-2025-62261

Summary of CVE-2025-62261 (Liferay Portal / Liferay DXP) Affected products/versions (per connected sources): Liferay Portal 7.4.0–7.4.3.99 and older unsupported versions; Liferay DXP 2023.Q3.1–2023.Q3.4; 7.4 GA through update 92; 7.3 GA through update 34. Root cause and impact: Password reset tok...

CVE-2025-62261

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to...

How to set up two factor authentication (2FA) on your Instagram account

Two-factor authentication 2FA isn't foolproof, but it is one of the best ways to protect your accounts from hackers. It adds a small extra step when logging in, but that extra effort pays off. Instagram’s 2FA requires an additional code whenever you try to log in from an unrecognized device or...

CVE-2025-12080

CVE-2025-12080 affects Google Messages for Wear OS when it is the default SMS/MMS/RCS app. The root cause is improper handling of ACTION_SENDTO intents using sms:, smsto:, mms:, and mmsto: URI schemes, enabling an attacker who can invoke an Android intent to covertly send messages on behalf of th...

EUVD-2025-36025

Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through = 1.4.0...

Evaluation of Vision-LLMs in Surveillance Video

The widespread use of cameras in our society has created an overwhelming amount of video data, far exceeding the capacity for human monitoring. This presents a critical challenge for public safety and security, as the timely detection of anomalous or criminal events is crucial for effective...

SourceForge EasyWork Enterprise security vulnerabilities

Sourceforge Easywork Enterprise is a Sourceforge open source enterprise management system. A security vulnerability exists in Sourceforge Easywork Enterprise version 2.1.3.354, which originates from storing sensitive information in memory in clear text and could lead to unauthorized activation of...

Liferay Portal and Liferay DXP security vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

PT-2025-44047

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.99 Liferay Portal versions 7.4 GA through update 92 Liferay Portal versions 7.3 GA through update 34 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Older unsupported versions of Liferay Portal and...

CVE-2025-11823

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonexisttext' parameter in the 'wishsuitebutton' shortcode in all versions up to, and including, 3.2.4 due to insufficient...

CVE-2025-12016

The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquizcustomstarttext' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-11823 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonexisttext' parameter in the 'wishsuitebutton' shortcode in all versions up to, and including, 3.2.4 due to insufficient...

CVE-2025-11823

CVE-2025-11823 concerns ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules (WordPress). Wordfence and patch sources indicate a Stored Cross-Site Scripting vulnerability via the shortcodes parameter button_exist_text in wishsuite_button, exploitable on all versions up to and in...

Cross-site Scripting (XSS)

com.liferay, com.liferay.dynamic.data.mapping.form.field.type is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation of user-supplied input in "Rich Text" type fields within web content structures, document types, or custom assets using the Data Engine module,...

Enhanced MLLM Black-Box Jailbreaking Attacks and Defenses

Multimodal large language models MLLMs comprise of both visual and textual modalities to process vision language tasks. However, MLLMs are vulnerable to security-related issues, such as jailbreak attacks that alter the model's input to induce unauthorized or harmful responses. The incorporation o...

pgcodekeeper security vulnerability

pgCodeKeeper is an open source Eclipse plugin for database schema management from pgCodeKeeper. A security vulnerability exists in pgcodekeeper version 10.12.0, which stems from storing passwords and usernames in clear text and could lead to the disclosure of sensitive information...

Security Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla

Modern connected vehicles rely on persistent LTE connectivity to enable remote diagnostics, over-the-air OTA updates, and critical safety services. While mobile network vulnerabilities are well documented in the smartphone ecosystem, their impact in safety-critical automotive settings remains...

PT-2025-43598

Name of the Vulnerable Software and Affected Versions qnotsquiz plugin for WordPress versions prior to 1.0.1 Description The qnotsquiz plugin for WordPress is susceptible to Stored Cross-Site Scripting through the qnotsquiz custom start text parameter. Insufficient input sanitization and output...