To buy or not to buy: How cybercriminals capitalize on Black Friday

The global e‑commerce market is accelerating faster than ever before, driven by expanding online retail, and rising consumer adoption worldwide. According to McKinsey Global Institute, global e‑commerce is projected to grow by 7–9% annually through 2040. At Kaspersky, we track how this surge in...

Exploit for Improper Authentication in Oracle Concurrent_Processing

CVE-2025-61882 & CVE-2025-61884 EDIT: Oracle just disclose...

TencentOS Server 3: ca-certificates bug fix and enhancement update (Low) (TSSA-2024:0591)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0591 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /server-islands/name endpoint when handling the e, s and p parameters. An attacker can execute...

Malicious code in grrrck.positron-plus-1-e (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 820ed4b566cf0f19a7737abc11d761b56b64960adae0b4a7e53d3e95a31cf59a This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

CVE-2025-9977 Improper neutralization of input in Times Software E-PAYROLL

Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been...

CVE-2025-9977

CVE-2025-9977 affects Times Software E-Payroll. The issue stems from improper sanitization of data in a POST parameter during login, which could let an unauthenticated attacker cause a DoS and may enable SQL injection; command injection attempts have also produced detailed error messages exposing...

SUSE-SU-2025:4111-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50327: ACPI: processor: idle: Check acpifetchacpidev return value bsc1249859. - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfsparseparam bsc1249857. ...

CVE-2025-13119

A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used...

Bdtask Isshue - Multi Store eCommerce Shopping Cart Solution 代码注入漏洞

Bdtask Isshue - Multi Store eCommerce Shopping Cart Solution is an e-commerce shopping cart system from Bdtask Bangladesh. A code injection vulnerability exists in Bdtask Isshue - Multi Store eCommerce Shopping Cart Solution version 4.0 and prior versions, which originates from an incorrect...

CVE-2025-13119

A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2025-13119

A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2025-13119 Fabian Ros/SourceCodester Simple E-Banking System cross-site request forgery

A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used...

EUVD-2025-175309

A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2025-13119

CVE-2025-13119 affects Fabian Ros/SourceCodester Simple E-Banking System 1.0. A CSRF vulnerability is described as originating from an unknown part of the application; the attack can be initiated remotely and an exploit has been published. The available sources do not specify the exact affected c...

CVE-2025-13119 Fabian Ros/SourceCodester Simple E-Banking System cross-site request forgery

A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2025-12979

CVE-2025-12979 describes an unauthorized data exposure vulnerability in the WordPress plug‑in Welcart e-Commerce . A missing capability check on the usces_export action affects all versions up to and including 2.11.24 , allowing unauthenticated attackers to access sensitive data such as configure...

CVE-2025-12979 Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure

The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uscesexport' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials ex...

SourceCodester Simple E-Banking System 安全漏洞

SourceCodester Simple E-Banking System is a SourceCodester open source simple e-banking system. A security vulnerability exists in SourceCodester Simple E-Banking System version 1.0, which stems from vulnerability to cross-site request forgery attacks...

Enhanced Anonymous Credentials for E-Voting Systems

A simple and practical method for achieving everlasting privacy in e-voting systems, without relying on advanced cryptographic techniques, is to use anonymous voter credentials. The simplicity of this approach may, however, create some challenges, when combined with other security features, such ...