Malicious code in a-vailable-al-bum-file-9447-dots-and-loops-ee4hh-qjicit (npm)

The package a-vailable-al-bum-file-9447-dots-and-loops-ee4hh-qjicit was found to contain malicious code...

Malicious code in new-al-bum-av-ailable-2017-84902-three-futures-eheyb-czhdsw (npm)

The package new-al-bum-av-ailable-2017-84902-three-futures-eheyb-czhdsw was found to contain malicious code...

Malicious code in new-al-bum-av-ailable-24973-black-dialogue-hdrb2-ckuphe (npm)

The package new-al-bum-av-ailable-24973-black-dialogue-hdrb2-ckuphe was found to contain malicious code...

MAL-2025-13916 Malicious code in a-vailable-al-bum-file-185797-likewise-tc2je-eosyti (npm)

The package a-vailable-al-bum-file-185797-likewise-tc2je-eosyti was found to contain malicious code...

MAL-2025-13922 Malicious code in a-vailable-al-bum-file-21779-stoosh-ejqig-iuyzvg (npm)

The package a-vailable-al-bum-file-21779-stoosh-ejqig-iuyzvg was found to contain malicious code...

MAL-2025-13929 Malicious code in a-vailable-al-bum-file-emika-xmauh-mdepdk (npm)

The package a-vailable-al-bum-file-emika-xmauh-mdepdk was found to contain malicious code...

MAL-2025-27352 Malicious code in new-al-bum-av-ailable-curse-your-branches-9opbb-omehez (npm)

The package new-al-bum-av-ailable-curse-your-branches-9opbb-omehez was found to contain malicious code...

CVE-2024-5729

The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

📄 Ibn Al Haithm 1.0 Insecure Direct Object Reference

Ibn Al Haithm version 1.0 suffers from an insecure direct object reference vulnerability. Exploit Title: Ibn Al Haithm intlaqcit.com - Multiple Vulnerabilities Date: May 19, 2025 Exploit Author: wa03 Telegram: @wa03 Vendor Homepage: intlaqcit.com Version: 1.0 CVE: N/A Google Dork: intxt: Ibn Al...

📄 WordPress User Registration and Membership 4.1.1 Privilege Escalation

WordPress User Registration and Membership plugin versions 4.1.1 and below suffer from a privilege escalation vulnerability. Exploit Title: WordPress User Registration & Membership Plugin = 4.1.1 - Unauthenticated Privilege Escalation Exploit Author: Al Baradi Joy Date: 2025-04-07 Vendor Homepage...

📄 Microsoft SQL Server 2022 Missing Log Entry

Microsoft SQL Server 2022 fails to properly log when a security audit is configured for SERVERPERMISSIONCHANGEGROUP. Title: SQL Server 2022 Security Audit Failure Vulnerability Product: Microsoft SQL Server Affected Versions: 2022 RTM-CU18 KB5050771 Tested Versions: 2022 RTM-CU18 KB5050771 Fix:...

Apache Tomcat 11.0.3 - Remote Code Execution

Exploit Title: Apache Tomcat Path Equivalence - Remote Code Execution Exploit Author: Al Baradi Joy CVE: CVE-2025-24813 Date: 2025-04-06 Vendor Homepage: https://tomcat.apache.org/ Software Link: https://tomcat.apache.org/download-90.cgi Version: Apache Tomcat 11.0.3 / 10.1.35 / 9.0.98 Tested on:...

Malicious code in al-schematics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa23abde2f15732ece6a95eca8e1692816abedb8fe470840b8d8fd6c1121f18d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-49218

Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through = 1.1...

MAL-2024-9324 Malicious code in a-vailable-al-bum-file-476579-blood-karaok-fs2b7-phmwby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 903467a052324571eebe90d006e8f80620c8ae0f68876c88dbf62737c99a7613 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-49218

Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through = 1.1...

CVE-2024-49218

CVE-2024-49218: WordPress Recently plugin (<= 1.1) suffers Deserialization of Untrusted Data leading to PHP Object Injection. Public docs (Wordfence/WP community feeds and patch databases) confirm the vulnerability in the Recently plugin for WooCommerce, with a high CVSS score (3.1: Network, N...

Story of an Undercover CIA Agent who Penetrated Al Qaeda

Rolling Stone has a long investigative story non-paywalled version here about a CIA agent who spent years posing as an Islamic radical. Unrelated, but also in the "real life spies" file: a fake Sudanese diving resort run by Mossad...

dietandfitnesstoday.com Cross Site Scripting vulnerability OBB-3958002

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

maxconcept.com.hk Cross Site Scripting vulnerability OBB-3957984

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...