CVE-2024-13940 Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook

The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitra...

IDOR Vulnerability in Template Creation via `projectId` Manipulation

Description An Insecure Direct Object Reference IDOR vulnerability exists in the POST /v1/templates endpoint of the Lunary API. This allows an authenticated user to create templates in another user’s project by modifying the projectId query parameter. This occurs due to a lack of server-side...

CVE-2025-42997 Information Disclosure vulnerability in SAP Gateway Client

Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on...

Amazon Linux 2 : jetty (ALAS-2025-2855)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2855 advisory. For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On...

Low: jetty

Issue Overview: For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a...

CVE-2025-47274

CVE-2025-47274 affects ToolHive, a utility for deploying/managing MCP servers. The issue arises from the startup code ordering that causes sensitive data to be written into run configuration files used to restart stopped MCP containers. An attacker with access to the user’s home directory can rea...

Pegasus-Pentest-Arsenal - A Comprehensive Web Application Security Testing Toolkit That Combines 10 Powerful Penetration Testing Features Into One Tool

/\ / | / \ | \ | || | | | | / | /| |/ |/ |/ ,/; ; ; ,'/|; ,/,/, ,'/ |;/,/,/,/| ,/; |;|/,/,/,/,/| ,/'; |;|,/,/,/,/,/| ,/'; |;|/,/,/,/,/,/|, / ; |;|,/,/,/,/,/,/| / ,'; |;|/,/,/,/,/,/,/| /,/'; |;|,/,/,/,/,/,/,/| /;/ '; |;|/,/,/,/,/,/,/,/| ██████╗ ███████╗ ██████╗ █████╗ ███████╗██╗ ██╗███████╗...

PT-2025-20551

Name of the Vulnerable Software and Affected Versions Kong Insomnia Desktop Application versions prior to 11.0.2 Description The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string...

Security Steerability Is All You Need

The adoption of Generative AI GenAI in various applications inevitably comes with expanding the attack surface, combining new security threats along with the traditional ones. Consequently, numerous research and industrial initiatives aim to mitigate these security threats in GenAI by developing...

CVE-2025-37818

creationtimestamp| type| source ---|---|--- 2025-05-08 07:23:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15491 2025-05-08 08:31:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loniqqtvxp2h 2025-05-08 11:45:01+00:00| seen|...

CVE-2025-37819

creationtimestamp| type| source ---|---|--- 2025-05-08 07:23:15+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15490 2025-05-08 08:31:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loniqqxfmz2r 2025-05-08 11:45:06+00:00| published-proof-of-concept|...

A Bootiful Podcast: V Körbes on security from the platform on up

Hi, Spring fans! In today's extra special installment I talk to Broadcom's V Körbes who works on security above and below the application...

CVE-2025-47667

creationtimestamp| type| source ---|---|--- 2025-05-07 18:22:47+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15364 2025-05-07 18:27:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lolzkeeo3222 2025-05-07 19:00:54+00:00| seen| https://t.me/cvedetector/24729...

CVE-2025-47635 WordPress WebinarPress plugin <= 1.33.28 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects WebinarPress: from n/a through = 1.33.28...

CVE-2025-3766

creationtimestamp| type| source ---|---|--- 2025-05-07 05:21:49+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15269 2025-05-07 08:26:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokxyklrhm2w 2025-05-07 08:53:11+00:00| seen|...

Radware Cloud Web Application Firewall Vulnerable to Filter Bypass

Overview The Radware Cloud Web Application Firewall is vulnerable to filter bypass by multiple means. The first is via specially crafted HTTP request and the second being insufficient validation of user-supplied input when processing a special character. An attacker with knowledge of these...

Redefining Application Security: Imperva’s Vision for the Future

It’s no secret that web applications have undergone a significant transformation over the past few years. The widespread adoption of containerization, serverless computing, low-code development, APIs, and microservices has redefined how applications are built, deployed, and scaled. According to...

CVE-2024-58135

Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand...

CVE-2024-58135

Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand...

CVE-2025-3858

creationtimestamp| type| source ---|---|--- 2025-05-02 04:15:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14428 2025-05-02 07:34:35+00:00| seen| https://t.me/cvedetector/24311 2025-05-02 08:00:41+00:00| seen|...