CVE-2025-1746

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal...

CVE-2025-1776

Cross-Site Scripting XSS vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies...

CVE-2025-1746

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal...

CVE-2025-1776 Cross-Site Scripting (XSS) vulnerability in Soteshop

Cross-Site Scripting XSS vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies...

CVE-2025-1776 Cross-Site Scripting (XSS) vulnerability in Soteshop

Cross-Site Scripting XSS vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies...

CVE-2025-1776

CVE-2025-1776 concerns Soteshop before version 8.3.4, where the query parameter in /app-google-custom-search/searchResults is vulnerable to Cross-Site Scripting (XSS). The underlying issue allows an attacker to execute arbitrary code, potentially stealing sensitive data such as session cookies or...

CVE-2025-1746 Cross-Site Scripting vulnerability in OpenCart

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal...

CVE-2025-1746

OpenCart vulnerable to Cross-Site Scripting (XSS) before version 4.1.0. The issue occurs via a crafted URL sent to the /product/search endpoint, allowing JavaScript to execute in the victim’s browser and potentially steal session cookies or perform actions on behalf of the user. Public references...

CVE-2025-1746 Cross-Site Scripting vulnerability in OpenCart

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal...

Dell Secure Connect Gateway SQL Injection Vulnerability

The Dell Secure Connect Gateway Dell SCG is a secure connectivity gateway from Dell, USA. The Dell Secure Connect Gateway suffers from an SQL injection vulnerability that originates from improper neutralization of special elements in SQL commands, which can be exploited by an attacker to execute...

Hackers Impersonate Taiwan’s Tax Authority to Deploy Winos 4.0 Malware

FortiGuard Labs discovers Winos 4.0 malware targeting Taiwan via phishing. Learn how this advanced threat steals data and…...

Cisco APIC 跨站脚本漏洞

Cisco Application Policy Infrastructure Controller is a software for Cisco ACI switching matrix automation and management from Cisco. The Cisco Application Policy Infrastructure Controller suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject malicious...

Siemens Teamcenter Redirection Vulnerability

Teamcenter software is an adaptable, modern Product Lifecycle Management PLM system that connects people and processes across functional silos through digital threads to enable innovation. A redirection vulnerability exists in the Siemens Teamcenter SSO login service, which can be exploited by an...

Predatory app downloaded 100,000 times from Google Play Store steals data, uses it for blackmail

A malicious app claiming to be a financial management tool has been downloaded 100,000 times from the Google Play Store. The app— known as “Finance Simplified”—belongs to the SpyLoan family which specializes in predatory lending. Sometimes malware creators manage to get their apps listed in the...

GitVenom Malware Steals $456K in Bitcoin Using Fake GitHub Projects to Hijack Wallets

Cybersecurity researchers are calling attention to an ongoing campaign that's targeting gamers and cryptocurrency investors under the guise of open-source projects hosted on GitHub. The campaign, which spans hundreds of repositories, has been dubbed GitVenom by Kaspersky. "The infected projects...

Dell Secure Connect Gateway SQL注入漏洞

The Dell Secure Connect Gateway Dell SCG is a secure connectivity gateway from Dell, USA. The Dell Secure Connect Gateway suffers from an SQL injection vulnerability that originates from improper neutralization of special elements in SQL commands, which can be exploited by an attacker to execute...

Moodle 安全漏洞

Moodle is an open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle. The vulnerability stems from insufficient cleanup and leads to a cross-site scripting...

CVE-2020-6158

Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing...

PHPGurukul Online Shopping Portal 注入漏洞

Online Shopping Portal is an online store system. Online Shopping Portal suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter Product of the file /search-result.php. An attacker can exploit this vulnerability to...

Leantime allows Refelected Cross-Site Scripting (XSS)

Summary The vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation...