Dolibarr ERP & CRM 安全漏洞

Dolibarr ERP & CRM is an enterprise management software from Dolibarr Open Source. A security vulnerability exists in Dolibarr ERP & CRM version 21.0.1 due to a remote code execution vulnerability in the computed field parameter of the User module configuration...

US Auto Insurance Platform ClaimPix Leaked 10.7TB of Records Online

Cybersecurity researcher Jeremiah Fowler discovered a massive 10.7TB ClaimPix leak exposing 5.1M customer files, vehicle data, and Power of Attorney documents. Read the full details...

CVE-2025-7038

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the stepsloadstep route of the latepointroutecall AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and relate...

CVE-2025-7038

The vulnerability CVE-2025-7038 affects LatePoint for WordPress (up to v5.1.94). The issue is an Authentication Bypass in the steps__load_step path of the latepoint_route_call AJAX endpoint, where client-supplied customer email/fields are used before login verification or nonce checks. Unauthenti...

CVE-2025-7038 LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the stepsloadstep route of the latepointroutecall AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and relate...

CVE-2025-7038 LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the stepsloadstep route of the latepointroutecall AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and relate...

CVE-2025-56807

A cross-site scripting XSS vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using the file explorer in the admin dashboard when creating new folders...

Harrods Data Breach: 430,000 Customer Records Stolen Via Third-Party Attack

Luxury retailer Harrods confirms 430,000 customer records names, contacts were stolen from a third-party provider in the latest UK retail cyberattack wave...

CVE-2025-10345

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'address' at the endpoint 'admin/leads/lead'...

CVE-2025-10346

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knoewledgebase/article'...

CVE-2025-10346 HTML injection in Perfex CRM

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knoewledgebase/article'...

PT-2025-39720

Name of the Vulnerable Software and Affected Versions PHPGurukul Small CRM version 4.0 Description A flaw exists in PHPGurukul Small CRM 4.0 related to the processing of the email argument within a file, specifically /forgot-password.php. Manipulation of this argument can result in a SQL injectio...

Malicious code in example-legacy-customer-account-flow (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47665 Malicious code in example-legacy-customer-account-flow (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in customer-preference (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47651 Malicious code in customer-preference (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-60157 WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Stored XSS.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a throu...

What 400 Executives Reveal About the Future of AI Adoption

Learn how a Forrester study discovered that most companies are already using AI for competitive differentiation, personalization, and customer retention...

Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection

Cybersecurity researchers have disclosed a critical flaw impacting Salesforce Agentforce, a platform for building artificial intelligence AI agents, that could allow attackers to potentially exfiltrate sensitive data from its customer relationship management CRM tool by means of an indirect promp...

CVE-2025-10807

A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/edit-customer-detailed.php. The manipulation of the argument editid results in sql injection. The attack may be launched remotely. The exploit...