CVE-2025-14461 Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid

The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint wcxenditcallback that processes payment callbacks without any...

Avoid Scams After Disaster Strikes

As natural disasters occur, CISA urges individuals to remain on alert for potential malicious cyber activity. Fraudulent emails and social media messages—often containing malicious links or attachments—are common after major natural disasters. Exercise caution in handling emails with...

CVE-2025-13457

The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the gettokenbyid function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Squa...

EUVD-2026-1860

The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the gettokenbyid function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Squa...

CVE-2024-41670

In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer can confirm an order even if payment is finally declined by PayPal. A logical weakness during the capture of a payment in case of disable...

FBI Seizes Fake ID Template Domains Operating from Bangladesh

US authorities have charged Zahid Hasan with running TechTreek, a $2.9 million online marketplace selling fake ID templates. The investigation, involving the FBI and Bangladesh police, uncovered a global scheme selling fraudulent passports and social security cards to over 1,400 customers...

PT-2025-49107

Name of the Vulnerable Software and Affected Versions Step CA affected versions not specified Description A critical issue in Step CA allows for unauthenticated bypass, enabling the issuance of fraudulent certificates. This compromises trust in potentially millions of sites. The issue allows...

New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse

Sturnus, an advanced Android banking trojan, has been discovered by ThreatFabric. Learn how this malware bypasses end-to-end encryption on Signal and WhatsApp, steals bank credentials using fake screens, and executes fraudulent transactions...

HackOnChat: Unmasking the WhatsApp Hacking Scam

CTM360 has discovered a large-scale malicious campaign targeting WhatsApp users worldwide. This scam is designed to hijack WhatsApp accounts through deceptive phishing schemes that exploit user trust in the WhatsApp brand. Threat actors behind this campaign create fraudulent websites that closely...

WordPress Payments Braintree For WooCommerce plugin authorization bypass vulnerability

WordPress Payments Braintree For WooCommerce plugin is a payment plugin designed specifically for WordPress websites, which supports payments done through both PayPal and credit cards. The WordPress Payments Braintree For WooCommerce plugin suffers from an authorization bypass vulnerability that...

MAL-2025-172494 Malicious code in namei-mla-anu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5d08200ff8924a5da1b46728de88ef772a9bdf1b45c8d2f89d7991987cc8bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172031 Malicious code in yousafnoor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a8031860845a1d7baa38d6b652ff7e809df224366a867390a4fafd5257e3b25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fitra-poke32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1ae6d84e39ad8774a694bdceeb5c1ad3ca5b1034f342a6349e374f468c6c19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fitra-poke13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c9f00e23232b5d81776d42b4028c3d0d511a83be3c0ab339a2664348875638e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fitra-poke23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acbd766cd870d0fd3e71a463cbd0e81495849de7cf34d9ac73f6d0f344a506e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tealove-lady44 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f97f9049f7c4da2ac57ed5985d49626d7ed6559e28608089a797ff2237080cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155149 Malicious code in fitra-poke55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f95e71eac89bcf98b21f9b810893adc107960310f579738930967974dc3a2397 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12903 Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud

The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/vaultednonce REST API endpoint in all versions up to, and including, 3.2.78. This is due to the endpoint being registered with...

EUVD-2025-119984

The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/vaultednonce REST API endpoint in all versions up to, and including, 3.2.78. This is due to the endpoint being registered with...

MAL-2025-146124 Malicious code in perseus-webdriver-manager-norma-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cede82fc4266f2b965de537477b3e59d6b85b8a83c49ee724ad07025332c22d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...