Monica 安全漏洞

Monica is an AI assistant from Monica. A security vulnerability exists in Monica version v6.3.0, which stems from an instant injection vulnerability in the chat box that allows an attacker to access and steal all previous and subsequent chat data between a user and the AI assistant via a spoofed...

CodeGeeX 安全漏洞

CodeGeeX is an intelligent programming assistant from China-based Smart Spectrum Huazhang CodeGeeX. A security vulnerability exists in CodeGeeX version v2.17.0, which originates from a prompt injection in the chat box, allowing an attacker to access and steal all previous and subsequent chat data...

Hospital Management System change-password.php Page SQL Injection Vulnerability

Hospital Management System a hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the cpass parameter of the change-password.php page. An attacker can exploit this vulnerabili...

Unmasking Lumma Stealer: Analyzing Deceptive Tactics with Fake CAPTCHA

Summary Lumma Stealer is an information-stealing malware available through a Malware-as-a-Service MaaS. It specializes in stealing sensitive data such as passwords, browser information, and cryptocurrency wallet details. The attacker has advanced its tactics, moving from traditional phishing to...

Code-Projects Hospital Management System SQL注入漏洞

Hospital Management System a hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the cpass parameter of the change-password.php page. An attacker can exploit this vulnerabili...

Origin Validation Error

gradio is vulnerable to Origin Validation Error. The vulnerability is due the localhostaliases variable including "null" as a valid origin, when the server is deployed locally. An attacker can make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leadi...

OpenHIS SQL Injection Vulnerability

OpenHIS is a web-based hospital management application from China Xinzhi OpenHIS. A SQL injection vulnerability exists in OpenHIS v.1.0, which stems from a lack of validation of externally-entered SQL statements in the refund function of the PayController.class.php component. An attacker can...

JEPaaS SQL Injection Vulnerability

JEPaaS is a rapid development platform from China Kate Weiye JEPaaS. A SQL injection vulnerability exists in JEPaaS v7.2.8, which originates from the lack of validation of the orderSQL parameter of /homePortal/loadUserMsg for externally entered SQL statements. An attacker can exploit this...

GHSA-7C4C-749J-PFP2 Admidio Vulnerable to HTML Injection In The Messages Section

Summary An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. PoC 1. Go to https://www.admidio.org/demoen/admprogram/modules/messages/messages.php 2. Click on Send Private Message 3. In the Message field, enter the following payload...

Admidio Vulnerable to HTML Injection In The Messages Section

Summary An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. PoC 1. Go to https://www.admidio.org/demoen/admprogram/modules/messages/messages.php 2. Click on Send Private Message 3. In the Message field, enter the following payload...

CVE-2024-10033

A vulnerability was found in aap-gateway. A Cross-site Scripting XSS vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions a...

Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data

This article uncovers a Golang ransomware abusing AWS S3 for data theft, and masking as LockBit to further pressure victims. The discovery of hard-coded AWS credentials in these samples led to AWS account suspensions...

Fake LockBit, Real Damage: Ransomware Samples Abuse Amazon S3 to Steal Data

This article uncovers a Golang ransomware abusing Amazon S3 for data theft, and masking as LockBit to further pressure victims. The discovery of hard-coded AWS credentials in these samples led to AWS account suspensions...

PT-2024-32844 · Admidio · Admidio

Name of the Vulnerable Software and Affected Versions: Admidio versions prior to 4.3.12 Description: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. This issue can lead to various impacts, including data theft, session hijacking,...

Zero-day Flaws Exposed EV Chargers to Shutdowns and Data Theft

NCC Group experts share details of how they exploited critical zero-day vulnerabilities in Phoenix Contact EV chargers electric…...

JEPaaS 安全漏洞

JEPaaS is a rapid development platform from China Kate Weiye JEPaaS. A SQL injection vulnerability exists in JEPaaS v7.2.8, which originates from the lack of validation of the orderSQL parameter of /homePortal/loadUserMsg for externally entered SQL statements. An attacker can exploit this...

A Mysterious Hacking Group Has 2 New Tools to Steal Data From Air-Gapped Machines

It's hard enough creating one air-gap-jumping tool. Researchers say the group GoldenJackal did it twice in five years...

OpenHIS 安全漏洞

OpenHIS is a web-based hospital management application from China Xinzhi OpenHIS. A SQL injection vulnerability exists in OpenHIS v.1.0, which stems from a lack of validation of externally-entered SQL statements in the refund function of the PayController.class.php component. An attacker can...

CVE-2024-48772

An issue in C-CHIP com.cchip.cchipamaota v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process...

TaskMatic 安全漏洞

TaskMatic is an automation assistant from TaskMatic. TaskMatic version 1.0 suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL commands to steal...