HuoCMS 安全漏洞

Suq HuoCMS is a modern content management system based on ThinkPHP6 and Vue3 developed by Nanjing Digital Flag Technology Suq Company in China. A security vulnerability exists in HuoCMS 3.5.1 and earlier versions, which stems from a file upload feature that could lead to server compromise...

HuoCMS 安全漏洞

Suq HuoCMS is a modern content management system based on ThinkPHP6 and Vue3 developed by Nanjing Digital Flag Technology Suq Company in China. A security vulnerability exists in HuoCMS version 3.5.1, which stems from a file upload feature that may bypass whitelisting restrictions and lead to...

WordPress Easy Digital Downloads plugin <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via eddreceipt Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Easy Digital Downloads versions = 3.3.8.1...

The Privacy-Friendly Tech to Replace Your US-Based Email, Browser, and Search

Thanks to drastic policy changes in the US and Big Tech’s embrace of the second Trump administration, many people are moving their digital lives abroad. Here are a few options to get you started...

Our capabilities. A story about what we can achieve

Introduction Over the years we have been fortunate to have been called upon to help with some challenging investigations. iPhone prize scams, ransomware attacks that weren't, aiding the Steele Dossier case, and even a fraudulent €14 million transfer. Here we've picked out the most interesting one...

A Hitchhiker'S Guide to Privacy-Preserving Cryptocurrencies: a Survey on Anonymity, Confidentiality, and Auditability

Cryptocurrencies and central bank digital currencies CBDCs are reshaping the monetary landscape, offering transparency and efficiency while raising critical concerns about user privacy and regulatory compliance. This survey provides a comprehensive and technically grounded overview of...

CVE-2025-22826

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpecommerce Sell Digital Downloads sell-digital-downloads allows Stored XSS.This issue affects Sell Digital Downloads: from n/a through = 2.2.7...

CVE-2025-22503

Cross-Site Request Forgery CSRF vulnerability in digitalzoomstudio Admin debug wordpress – enable debug dzs-enable-debug allows Cross Site Request Forgery.This issue affects Admin debug wordpress – enable debug: from n/a through = 1.0.13...

CVE-2024-43412

Xibo is an open source digital signage platform with a web content management system CMS. Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xib...

CVE-2024-47001

Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings...

CVE-2024-8297

A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth of the file middleware/jwtrefreshtokenmiddleware.go. The manipulation of the argument Authorization leads to improper output neutralizatio...

CVE-2024-42905

Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can be exploited to obtain device administrator privileges via the getVar function in the code/function/system/tool/ping.php file...

CVE-2024-22085

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable...

CVE-2024-22081

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur in the HTTP header parsing mechanism...

CVE-2024-22079

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Directory traversal can occur via the system logs download mechanism...

CVE-2024-22077

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions...

CVE-2024-22084

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Cleartext passwords and hashes are exposed through log files...

CVE-2024-22082

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory listing can occur: the web interface cay be abused be an attacker get a better understanding of the operating system...

CVE-2024-3334

A security bypass vulnerability exists in the Removable Media Encryption RMEcomponent of Digital Guardian Windows Agents prior to version 8.2.0. This allows a user to circumvent encryption controls by modifying metadata on the USB device thereby compromising the confidentiality of the stored data...

CVE-2024-6133

The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...