6525 matches found
PT-2025-14705 · Unknown · Custom Post Type Updates
Name of the Vulnerable Software and Affected Versions: Latest Custom Post Type Updates versions 1.3.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...
Payroll Management System SQL Injection Vulnerability (CNVD-2025-06475)
Payroll Management System is a payroll management system. A SQL injection vulnerability exists in Payroll Management System version 1.0 due to a lack of validation of externally entered SQL statements in the parameter emptype. An attacker can exploit this vulnerability to execute illegal SQL...
TookPS: DeepSeek isn’t the only game in town
In early March, we published a study detailing several malicious campaigns that exploited the popular DeepSeek LLM as a lure. Subsequent telemetry analysis indicated that the TookPS downloader, a malware strain detailed in the article, was not limited to mimicking neural networks. We identified...
CVE-2025-2072
A Reflected Cross-Site Scripting XSS vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a...
PT-2025-14410 · WordPress · Wordpress Galleria
Name of the Vulnerable Software and Affected Versions: WordPress Galleria versions 1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...
PT-2025-14413 · Unknown · Notfound Delete Post Revision
Name of the Vulnerable Software and Affected Versions: NotFound Delete Post Revision versions n/a through 1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables an attacker ...
PT-2025-14421 · Unknown · M. Tuhin Ultimate Push Notifications
Name of the Vulnerable Software and Affected Versions: M. Tuhin Ultimate Push Notifications versions 1.1.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attack...
PT-2025-14164 · Unknown · Raphaelheide Donate Me
Name of the Vulnerable Software and Affected Versions: raphaelheide Donate Me versions 1.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an attacker can...
PT-2025-14066 · Unknown · Aec Kiosque
Name of the Vulnerable Software and Affected Versions: AEC Kiosque versions 1.9.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This means that an attacker can injec...
PT-2025-14036 · Unknown · Pesapal Gateway For Woocommerce
Name of the Vulnerable Software and Affected Versions: Pesapal Gateway for Woocommerce versions 2.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...
PT-2025-14070 · Unknown · Primer Mydata For Woocommerce
Name of the Vulnerable Software and Affected Versions: Primer MyData for Woocommerce affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...
Russian Hackers Exploit CVE-2025-26633 via MSC EvilTwin to Deploy SilentPrism and DarkWisp
The threat actors behind the zero-day exploitation of a recently-patched security vulnerability in Microsoft Windows have been found to deliver two new backdoors called SilentPrism and DarkWisp. The activity has been attributed to a suspected Russian hacking group called Water Gamayun, which is...
Russia-Linked Gamaredon Uses Troop-Related Lures to Deploy Remcos RAT in Ukraine
Entities in Ukraine have been targeted as part of a phishing campaign designed to distribute a remote access trojan called Remcos RAT. "The file names use Russian words related to the movement of troops in Ukraine as a lure," Cisco Talos researcher Guilherme Venere said in a report published last...
CVE-2025-2072
A Reflected Cross-Site Scripting XSS vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a...
CVE-2025-2072
FAST LTA Silent Brick WebUI is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. The issue occurs when user-supplied input is reflected in output without proper sanitization or encoding, enabling arbitrary JavaScript execution in the victim’s browser. Affected WebUI parameters inc...
Exploit for CVE-2024-25600
CVE-2024-25600 Exploit - WordPress Bricks Builder Remote Code...
CVE-2025-2901
Rejected reason: This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234...
