PT-2025-20782 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.5 Description: An information disclosure issue was addressed with improved privacy controls. This issue allows an app to potentially access sensitive user data. Recommendations: For versions prior to 15.5, update to...

PT-2025-20764 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: iPadOS versions 17.7.7 and earlier macOS Ventura versions 13.7.6 and earlier macOS Sequoia versions 15.5 and earlier macOS Sonoma versions 14.7.6 and earlier Description: A logging issue was addressed with improved data redaction, which could...

Apple macOS 安全漏洞

Apple macOS is a set of specialized operating systems developed for Mac computers by Apple, Inc. A security vulnerability exists in Apple macOS that stems from an application that may access sensitive user data...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS that stems from a privacy issue and could lead to applications accessing sensitive user data...

CVE-2025-3851

The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

PT-2025-20453

Name of the Vulnerable Software and Affected Versions WPBookit plugin for WordPress versions up to, and including, 1.0.2 Description The issue is related to privilege escalation via account takeover. This is due to the plugin not properly validating a user's identity prior to updating their detai...

BIT-OPENCART-2025-1746 Cross-Site Scripting vulnerability in OpenCart

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal...

CVE-2025-46340

Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in UrlPreviewService and MkUrlPreview, it is possible for an attacker to inject arbitrary CSS into the MkUrlPreview component...

CVE-2025-3851

The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

CVE-2025-3851

CVE-2025-3851 affects the WordPress plug‑in WP SmartPay (Download Manager and Payment Form) . The issue is an Insecure Direct Object Reference in the show() function caused by missing validation on a user‑controlled key, which could allow an authenticated attacker with Subscriber+ privileges to v...

CVE-2025-3851 Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure

The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

IBM Operational Decision Manager Cross-Site Scripting Vulnerability

IBM Operational Decision Manager is a decision management solution from International Business Machines IBM used to help organizations better manage and enforce business rules and decisions. IBM Operational Decision Manager suffers from a cross-site scripting vulnerability that stems from the...

PT-2025-20285 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions up to and including 3.3.0 Description: An unauthenticated SQL Injection issue was identified in the endpoint "/html/socio/sistema/get socios.php", specifically in the query parameter. This allows attackers to inject and execute...

PT-2025-19907 · WordPress · Wp Smartpay

Name of the Vulnerable Software and Affected Versions: WP SmartPay plugin for WordPress versions 1.1.0 through 2.7.13 Description: The issue allows authenticated attackers with Subscriber-level access and above to view other users' data, including email addresses, names, and notes, due to missing...

SAMSUNG Gallery 安全漏洞

SAMSUNG Gallery is an application from the South Korean company Samsung SAMSUNG. The best image and video viewing application for Galaxy users. A security vulnerability exists in SAMSUNG Gallery that stems from improper access control and could lead to a physical attacker accessing cross user...

WordPress plugin WP SmartPay 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...

PT-2025-20220 · Woobox · Woobox

Name of the Vulnerable Software and Affected Versions: Woobox versions n/a through 1.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. Specifically, it is a DOM-Based XSS vulnerability, which allows attackers to...

“Your privacy is a promise we don’t break”: Dating app Raw exposes sensitive user data

Any app that hands over user data is a concern, but leaky dating apps are especially worrying given the sensitivity of the data involved. A relatively new app called Raw that aims to rewrite the rules of dating is the latest to trip over its coattails by exposing user data to…well, anyone who ask...

New Investment Scams Use Facebook Ads, RDGA Domains, and IP Checks to Filter Victims

Cybersecurity researchers have lifted the lid on two threat actors that orchestrate investment scams through spoofed celebrity endorsements and conceal their activity through traffic distribution systems TDSes. The activity clusters have been codenamed Reckless Rabbit and Ruthless Rabbit by DNS...

CVE-2025-40621

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’...