6525 matches found
Hackers Use XWorm RAT to Exploit Script Kiddies, Pwning 18,000 Devices
Crooks pwning crooks - Hackers exploit script kiddies with XWorm RAT, compromising 18,000+ devices globally and stealing sensitive…...
Mysiteforme SQL Injection Vulnerability
Mysiteforme is a permission management system. A SQL injection vulnerability exists in versions of Mysiteforme prior to 2025.01.01, which stems from the lack of validation of the sname parameter in table/list for externally entered SQL statements. An attacker can exploit this vulnerability to...
PT-2025-5382 · Unknown +1 · Phpmyadmin +1
Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions prior to 5.2.2 Description: An issue has been discovered in the Insert tab of phpMyAdmin, where a Cross-Site Scripting XSS vulnerability has been found. This allows for malicious scripts to be injected into the webpage,...
Cross site scripting in Silverpeas Core
Stored Cross-Site Scripting XSS Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 = 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The...
GHSA-788M-27G4-CF86 Cross site scripting in Silverpeas Core
Stored Cross-Site Scripting XSS Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 = 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The...
CVE-2024-56923
Stored Cross-Site Scripting XSS Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 = 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The...
CVE-2024-56924
A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...
PT-2025-5098 · Unknown +1 · Buddypress +1
Name of the Vulnerable Software and Affected Versions: Eliott Robson Mass Messaging in BuddyPress versions n/a through 2.2.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means an attacke...
CVE-2024-56923
Silverpeas Core (versions 6.3.1–6.4.1) is affected by a Stored XSS in the Categorization option of the My Subscriptions feature. An attacker can inject JavaScript via the Name field of a subscription, enabling code execution when an admin views the subscription. The vulnerability is described acr...
CVE-2024-56923
Stored Cross-Site Scripting XSS Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 = 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The...
Imperva Protects Against the Exploited CVEs in the Cleo Data Theft Attacks
The Clop ransomware group has once again demonstrated its ability to exploit vulnerabilities to compromise sensitive systems. As Cleo—a managed file transfer provider for businesses—grapples with the aftermath of Clop’s targeted attack on their systems, the spotlight turns to CVE-2024-50623 and...
CVE-2025-24017
YesWiki DOM-based XSS (CVE-2025-24017) affects YesWiki up to version 4.4.5. The vulnerability stems from insufficient sanitization in the tag-search workflow: when a user-provided tag is reflected on pages, it can inject client-side script, enabling an attacker to craft a malicious link that trig...
Code-Projects Chat System 注入漏洞
Chat System is a chat system. Chat System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter id of the file /user/leaveroom.php. An attacker can exploit this vulnerability to execute illegal SQL commands to steal...
Selesta Visual Access Manager SQL Injection Vulnerability
Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that stems from a lack of validation of the GET parameter of /common/ajaxfunction.php against an externally entered SQL statement. An attacker can exploi...
Chat System deleteroom.php File SQL Injection Vulnerability
Chat System is a chat system. Chat System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter id of the /admin/deleteroom.php file. An attacker can exploit this vulnerability to execute illegal SQL commands t...
CVE-2024-55924
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...
CVE-2025-0060 Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged...
WordPress Skimmers Evade Detection by Injecting Themselves into Database Tables
Cybersecurity researchers are warning of a new stealthy credit card skimmer campaign that targets WordPress e-commerce checkout pages by inserting malicious JavaScript code into a database table associated with the content management system CMS. "This credit card skimmer malware targeting WordPre...
Selesta Visual Access Manager 安全漏洞
Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that stems from a lack of validation of the GET parameter of /common/ajaxfunction.php against an externally entered SQL statement. An attacker can exploi...