CVE-2025-58682 WordPress Kama Click Counter plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through = 4.0.4...

WordPress plugin Kama Click Counter 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-57911: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Adverts adverts-click-tracker allows DOM-Based XSS.This issue affects Adverts: from n/a through = 1.4...

CVE-2025-58682: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through = 4.0.4...

PT-2025-38970

Name of the Vulnerable Software and Affected Versions Kama Click Counter versions through 4.0.4 Description A flaw exists in Kama Click Counter that allows for Stored Cross-site Scripting XSS. This issue arises from improper handling of user-supplied input during web page generation. The...

ShadowLeak Zero-Click Flaw Leaks Gmail Data via OpenAI ChatGPT Deep Research Agent

Cybersecurity researchers have disclosed a zero-click flaw in OpenAI ChatGPT's Deep Research agent that could allow an attacker to leak sensitive Gmail inbox data with a single crafted email without any user action. The new class of attack has been codenamed ShadowLeak by Radware. Following...

CVE-2025-10002: Improper Neutralization of Special Elements used in an SQL Command

The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the exportcsv function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of...

ChatGPT Deep Research zero-click vulnerability fixed by OpenAI

OpenAI has moved quickly to patch a vulnerability known as “ShadowLeak” before anyone detected real-world abuse. Revealed by researchers yesterday, ShadowLeak was an issue in OpenAI’s Deep Research project that attackers could exploit by simply sending an email to the target. Deep Research was...

Click Studios Passwordstate 安全漏洞

Click Studios Passwordstate passwordstate is a password management software from the Click Studios team in Australia. The program provides users with the ability to save their passwords, record their accounts and passwords, and keep them safe. This program provides you with the ability to save yo...

CVE-2025-59453: Incorrect Resource Transfer Between Spheres

Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unauthorized person can gain access to the Passwordstate Administration section...

6 Browser-Based Attacks Security Teams Need to Prepare For Right Now

Attacks that target users in their web browsers have seen an unprecedented rise in recent years. In this article, we'll explore what a "browser-based attack" is, and why they're proving to be so effective. What is a browser-based attack? First, it's important to establish what a browser-based...

Exploit for Use After Free in Microsoft

CVE Analysis & Detection — PoCs, Snort Detection, and Mitigati...

Apple Warns French Users of Fourth Spyware Campaign in 2025, CERT-FR Confirms

Apple has notified users in France of a spyware campaign targeting their devices, according to the Computer Emergency Response Team of France CERT-FR. The agency said the alerts were sent out on September 3, 2025, making it the fourth time this year that Apple has notified citizens in the county...

Fedora 41 : checkpointctl (2025-cecd883ce1)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-cecd883ce1 advisory. Add python3-click build dependency ---- Update to upstream version 1.4.0 Tenable has extracted the preceding description block directly from the Fedora...

Fedora 43 : checkpointctl (2025-9b094ba1d6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-9b094ba1d6 advisory. Add python3-click build dependency ---- Update to upstream version 1.4.0 Tenable has extracted the preceding description block directly from the Fedora...

Fedora 42 : checkpointctl (2025-ba1dacf88c)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ba1dacf88c advisory. Add python3-click build dependency ---- Update to upstream version 1.4.0 Tenable has extracted the preceding description block directly from the Fedora...

Security Updates for Microsoft PowerPoint Products C2R (September 2025)

The Microsoft PowerPoint Products are missing a security update. It is, therefore, affected by the following vulnerability: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-54908 Note that Nessus h...

CVE-2025-53838

LinkAce is a self-hosted archive to collect website links. A stored cross-site scripting XSS vulnerability was discovered in versions prior to 2.1.9 that allows an attacker to inject arbitrary JavaScript, which is then executed in the context of a user's browser when the malicious link is clicked...

Linux Distros Unpatched Vulnerability : CVE-2024-28828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-Site request forgery in Checkmk 2.3.0p8, 2.2.0p29, 2.1.0p45, and = 2.0.0p39 EOL could lead to 1-click compromize of the site. CVE-2024-28828 Note that...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Sep 2025)

This host is missing a critical security update according to Microsoft Office Click-to-Run update September 2025. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...