217998 matches found
Spy vs. spy: How GenAI is powering defenders and attackers
Generative AI GenAI is reshaping cybersecurity for both attackers and defenders, but its future capabilities are difficult to measure as techniques and models are evolving rapidly. Adversaries continue to use GenAI with varying levels of reliance. State-sponsored groups continue to take advantage...
CVE-2025-13513
The Clik stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
EUVD-2025-201142
The Clik stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
PT-2025-49202
Name of the Vulnerable Software and Affected Versions Featured Image via URL plugin for WordPress versions prior to 0.1 Description The plugin is susceptible to arbitrary file uploads because of a lack of file type validation. Attackers with Contributor-level access or higher can upload any file ...
PT-2025-49200
Name of the Vulnerable Software and Affected Versions Hide Categories Or Products On Shop Page plugin for WordPress versions up to and including 1.0.7 Description The software is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation in the save data hcps function...
PT-2025-49189
Name of the Vulnerable Software and Affected Versions SurveyFunnel – Survey Plugin for WordPress versions through 1.1.5 Description The SurveyFunnel – Survey Plugin for WordPress is susceptible to Stored Cross-Site Scripting through the surveyfunnel lite survey shortcode. Insufficient input...
AirKeyboard iOS App 访问控制错误漏洞
AirKeyboard iOS App is a remote control application from AirKeyboard, Inc. An access control error vulnerability exists in AirKeyboard iOS App version 1.0.5, which stems from a lack of authentication and could allow an unauthenticated attacker to enter arbitrary keystrokes in real-time to a victi...
PT-2025-49130
WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execute malicious JavaScript code, enabling potential XSS attacks...
PT-2025-49025
Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-2 Synology DiskStation Manager DSM versions prior to 7.2.2-72806 Synology Unified Controller DSMUC versions prior to 3.1.4-23079 Description An out-of-bounds write issue exists in...
PT-2025-49236
Name of the Vulnerable Software and Affected Versions Cool Tag Cloud plugin for WordPress versions prior to 2.30 Description The Cool Tag Cloud plugin for WordPress is susceptible to Stored Cross-Site Scripting through the ‘cool tag cloud’ shortcode. This is due to inadequate input sanitization a...
PT-2025-49194
Name of the Vulnerable Software and Affected Versions SSP Debug plugin for WordPress versions prior to 1.0.1 Description The SSP Debug plugin for WordPress stores PHP error logs in a predictable, web-accessible location wp-content/uploads/ssp-debug/ssp-debug.log without access controls. This allo...
PT-2025-49134
Name of the Vulnerable Software and Affected Versions perl2exe versions prior to 30.10C Description perl2exe versions prior to 30.10C contain an arbitrary code execution issue. Local authenticated attackers can exploit this to execute malicious scripts. Specifically, attackers can control the 0th...
Medtronic CareLink Network 安全漏洞
Medtronic CareLink Network is an open source platform for remote monitoring of cardiac patients by Medtronic in the United States. A security vulnerability exists in versions of Medtronic CareLink Network prior to December 4, 2025, which stems from a local attacker being able to view plaintext...
The vulnerability of the App Lock module of the HarmonyOS operating system allows a intruder to compromise the accessibility of the protected information.
The vulnerability of the App Lock module in the HarmonyOS operating system is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to compromise the accessibility of protected information...
The vulnerability of the Linux operating system’s kernel media component allows a attacker to compromise the integrity and accessibility of protected information.
The vulnerability of the Linux operating system’s kernel media component is related to insufficient blocking measures. Exploiting this vulnerability allows an attacker to compromise the integrity and accessibility of the protected information...
The vulnerability of the Framework component in Android operating systems allows a hacker to trigger a service failure.
The vulnerability of the Framework component in Android operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...
CVE-2025-51683
A blind SQL Injection SQLi vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/updateprofileServer endpoint...
CVE-2025-7044
An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the issuperuser property set to true. The server improperly validates this input, allowing the attacker to...