Cross-site Scripting (XSS)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the domain field in the email creation form by redirecting users to malicious external websites. Details Cross-site scripting or XSS is a code...

Apple macOS 信息泄露漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS, which stems from state management improvements, and could lead to a cross-domain disclosure of data from malicious websites...

Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity

Introduction Among the most significant events in the AI world in early 2025 was the release of DeepSeek-R1 – a powerful reasoning large language model LLM with open weights. It's available both for local use and as a free service. Since DeepSeek was the first service to offer access to a reasoni...

Over 1,000 WordPress Sites Infected with JavaScript Backdoors Enabling Persistent Attacker Access

Over 1,000 websites powered by WordPress have been infected with a third-party JavaScript code that injects four separate backdoors. "Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed," c/side researcher Himanshu Anand said in ...

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

One of the most notorious providers of abuse-friendly "bulletproof" web hosting for cybercriminals has started routing its operations through networks run by the Russian antivirus and security firm Kaspersky Lab , KrebsOnSecurity has learned. Security experts say the Russia-based service provider...

Over 350 High-Profile Websites Hit by 360XSS Attack

360XSS campaign exploits Krpano XSS to hijack search results & distribute spam ads on 350+ sites, including government,…...

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CNVD-2025-23064)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. Microsoft Edge Chromium-based suffers from an elevation of privilege vulnerability, which can be exploited by attackers to access sensitive user data when visiting specially crafted...

Hackers Exploited Krpano Framework Flaw to Inject Spam Ads on 350+ Websites

A cross-site scripting XSS vulnerability in a virtual tour framework has been weaponized by malicious actors to inject malicious scripts across hundreds of websites with the goal of manipulating search results and fueling a spam ads campaign at scale. Security researcher Oleg Zaytsev, in a report...

The vulnerability of Microsoft Edge relates to the redirection of URLs to unreliable websites when loading the login page, allowing attackers to circumvent existing security restrictions.

The vulnerability of Microsoft Edge relates to the redirection of URLs to unreliable websites when loading the login page. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions...

CVE-2025-0178

Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious...

CVE-2025-24607

Missing Authorization vulnerability in Northern Beaches Websites IdeaPush ideapush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IdeaPush: from n/a through = 8.71...

CVE-2025-0178

Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious...

CVE-2025-24607

The CVE-2025-24607 entry covers a Missing Authorization vulnerability in the WordPress IdeaPush plugin (versions up to 8.71). The underlying issue is broken access control due to misconfigured access levels, enabling exploitation over the network with high impact. Affected product: WordPress Idea...

CVE-2024-49796

IBM ApplinX 11.1 is reported vulnerable to a remote click hijack (clickjacking) when a user visits a malicious site, enabling the attacker to hijack the victim’s click actions and potentially facilitate further attacks. The vulnerability is tied to IBM ApplinX 11.1; IBM’s remediation is to upgrad...

CVE-2022-1513

A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website...

CVE-2022-22999

Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser. As a result, it may be possible to ga...

Fake Reddit and WeTransfer Sites are Pushing Malware

There are thousands of fake Reddit and WeTransfer webpages that are pushing malware. They exploit people who are using search engines to search sites like Reddit. Unsuspecting victims clicking on the link are taken to a fake WeTransfer site that mimicks the interface of the popular file-sharing...

Brave Desktop Browser Vulnerability Lets Malicious Sites Appear Trusted

A critical vulnerability in Brave Browser allows malicious websites to appear as trusted sources during file uploads/downloads. Learn…...

GHSA-4GF7-FF8X-HQ99 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site. Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject in their site and run the script. By using...

GHSA-2452-6XJ8-JH47 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Details While Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by...