Scattered Spider Hijacks VMware ESXi to Deploy Ransomware on Critical U.S. Infrastructure

The notorious cybercrime group known as Scattered Spider is targeting VMware ESXi hypervisors in attacks targeting retail, airline, and transportation sectors in North America. "The group's core tactics have remained consistent and do not rely on software exploits. Instead, they use a proven...

PT-2025-31112 · Ibm · Ibm Informix Dynamic Server

Name of the Vulnerable Software and Affected Versions: IBM Informix Dynamic Server versions 12.10 and 14.10 Description: IBM Informix Dynamic Server is susceptible to brute-force credential attacks due to an inadequate account lockout setting. This could allow a remote attacker to compromise...

PT-2025-31037 · Unknown · Exam Form Submission

Name of the Vulnerable Software and Affected Versions: code-projects Exam Form Submission version 1.0 Description: A vulnerability exists in an unknown functionality of the file /admin/delete s4.php. Manipulation of the ID argument leads to SQL injection, allowing for remote attacks. The exploit...

PT-2025-31675 · Unknown · Webfinger.Js

Name of the Vulnerable Software and Affected Versions: webfinger.js versions 2.8.0 and below Description: webfinger.js is a TypeScript-based WebFinger client used in browser and Node.js environments. The lookup function does not prevent access to localhost services, only checking for hosts that...

CVE-2025-8237 code-projects Exam Form Submission update_s1.php sql injection

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/updates1.php. The manipulation of the argument credits leads to sql injection. The attack may be initiated remotely. The exploit has be...

awesome-termux-hacking

This is an awesome list of Termux hacking tools. It appears to be a collection of various tools and frameworks for penetration testing, vulnerability assessment, and exploitation. The list includes tools for tasks such as: Subdomain enumeration e.g., Sublist3r Vulnerability scanning e.g., w3af,...

PT-2025-31015 · Code Projects · Exam Form Submission

Name of the Vulnerable Software and Affected Versions: code-projects Exam Form Submission version 1.0 Description: A critical issue exists in code-projects Exam Form Submission 1.0. The vulnerability is due to SQL injection, which can be triggered by manipulating the email argument in the /admin/...

PT-2025-31006 · Code Projects · Code-Projects Online Ordering System

Name of the Vulnerable Software and Affected Versions: code-projects Online Ordering System version 1.0 Description: A critical vulnerability exists in code-projects Online Ordering System 1.0. The vulnerability is due to a SQL injection flaw within an unknown function of the /admin/delete user.p...

PT-2025-30993 · Unknown · Jpacookieshop

Name of the Vulnerable Software and Affected Versions: jerryshensjf JPACookieShop 蛋糕商城JPA版 versions up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999 Description: A cross-site scripting issue exists due to the manipulation of the keyword argument within the goodsSearch function of the...

PT-2025-30996 · Unknown · Jpacookieshop

Name of the Vulnerable Software and Affected Versions: jerryshensjf JPACookieShop 蛋糕商城JPA版 affected versions not specified Description: A cross-site request forgery issue exists in the AdminTypeCustController.java file. The vulnerability allows for remote attacks. The exploit has been publicly...

CVE-2025-6588

The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-8097

CVE-2025-8097 affects WoodMart, a WordPress theme, with versions up to 8.2.6. Wordfence/NVD describe an Improper Input Validation in woodmart_update_cart_item, enabling unauthenticated users to manipulate cart quantities using fractional values and potentially drive totals to $0.00, effectively b...

CVE-2025-8198 MinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price Manipulation

The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.9.0. This is due to an insufficient check on quantity values when changing quantities in the cart. This makes it possible for unauthenticat...

FedBAP: Backdoor Defense Via Benign Adversarial Perturbation in Federated Learning

Federated Learning FL enables collaborative model training while preserving data privacy, but it is highly vulnerable to backdoor attacks. Most existing defense methods in FL have limited effectiveness due to their neglect of the model's over-reliance on backdoor triggers, particularly as the...

PT-2025-30979 · Unknown · Jingmen Zeyou Large File Upload Control

Name of the Vulnerable Software and Affected Versions: Jingmen Zeyou Large File Upload Control versions up to 6.3 Description: A critical issue exists in Jingmen Zeyou Large File Upload Control. The manipulation of the ID parameter in the /index.jsp file leads to SQL injection. This allows for...

PT-2025-30966 · Totolink · Totolink N600R +1

Name of the Vulnerable Software and Affected Versions: TOTOLINK N600R version 1.0.0.1 TOTOLINK X2000R version 1.0.0.1 Description: A critical vulnerability exists in the FTP Service component of the affected products. The issue is related to the manipulation of the vsftpd.conf file, leading to a...

CVE-2025-8164

CVE-2025-8164 affects code-projects Public Chat Room 1.0. The vulnerability is in the file send_message.php, where manipulation of the ID argument enables SQL injection. Exploitation is possible remotely and has been disclosed publicly. Multiple connected sources (NVD, Red Hat, CVE lists, and vul...

CVE-2025-34136 Commvault CommServe Web Server Unauthenticated SQL Injection

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed...

CVE-2025-5253 DoS in Kron Technologies' Kron PAM

Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS. This issue affects Kron PAM: before 3.7...

CVE-2025-31701

A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption e.g., crashes or remote code execution RCE. Some devices may have deployed protection mechanisms such as...