10 Critical Network Pentest Findings IT Teams Overlook

After conducting over 10,000 automated internal network penetration tests last year, vPenTest has uncovered a troubling reality that many businesses still have critical security gaps that attackers can easily exploit. Organizations often assume that firewalls, endpoint protection, and SIEMs are...

WordPress JobCareer Theme plugin <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrative Actions vulnerability

Missing Authorization to Authenticated Subscriber+ Multiple Administrative Actions vulnerability discovered by Lucio Sá in WordPress Theme JobCareer versions = 7.1...

Future-Proofing Business Continuity: BCDR Trends and Challenges for 2025

As IT environments grow more complex, IT professionals are facing unprecedented pressure to secure business-critical data. With hybrid work the new standard and cloud adoption on the rise, data is increasingly distributed across different environments, providers and locations, expanding the attac...

Webinar: Learn How ASPM Transforms Application Security from Reactive to Proactive

Are you tired of dealing with outdated security tools that never seem to give you the full picture? You're not alone. Many organizations struggle with piecing together scattered information, leaving your apps vulnerable to modern threats. That's why we're excited to introduce a smarter, unified...

The vulnerability of the virtual learning environment Moodle, related to insufficient protection of operational data, allows a intruder to gain unauthorized access to protected information.

The vulnerability in the virtual learning environment Moodle is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2025-2143 · WordPress · Alex Reservations

Name of the Vulnerable Software and Affected Versions: Alex Reservations: Smart Restaurant Booking plugin for WordPress versions up to, and including, 2.0.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'rr form' shortcode due to insufficient input sanitization...

PT-2025-1322 · Rockwell Automation · Factorytalk View Se

Name of the Vulnerable Software and Affected Versions: Rockwell Automation FactoryTalk View ME affected versions not specified Description: A remote code execution issue exists due to lack of input sanitation, which could allow a remote attacker to run commands or code as a high privileged user...

The vulnerability of the Azure Database for PostgreSQL Flexible Server’s database management system lies in the lack of measures taken at the control level to clean data. This allows attackers to execute arbitrary code and increase their privileges.

The vulnerability of the Azure Database for PostgreSQL Flexible Server database management system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code and increase their...

The vulnerability of the software for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP lies in the exposure of system data to unauthorized access within the controlled area. This allows attackers to disclose protected information.

The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP is related to the disclosure of system data that is not protected by permissions within the controlled area. Exploiting this vulnerability can allow a...

PT-2025-4644 · Unknown · My Tickets

Name of the Vulnerable Software and Affected Versions: My Tickets versions 2.0.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists ACLs. This means that certain functions or...

Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them

In the past year, cross-domain attacks have gained prominence as an emerging tactic among adversaries. These operations exploit weak points across multiple domains – including endpoints, identity systems and cloud environments – so the adversary can infiltrate organizations, move laterally and...

PT-2025-52554

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1:1.39.17-1deb12u1 MediaWiki versions prior to 1:1.43.6+dfsg-1deb13u1 Description Multiple security issues were identified in MediaWiki, a website engine used for collaborative work. These issues could lead to...

PT-2025-52555

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1:1.39.17-1deb12u1 MediaWiki versions prior to 1:1.43.6+dfsg-1deb13u1 Description Multiple security issues were identified in MediaWiki, a website engine used for collaborative work. These issues could lead to...

The vulnerability of Adobe Connect’s instant messaging program, related to the lack of protective measures for website structures, allows attackers to execute XSS attacks.

The vulnerability of the Adobe Connect instant messaging program relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute XSS attacks by injecting malicious scripts into form fields...

PT-2024-36136 · Seerox · Seerox Easy Blocks Pro

Name of the Vulnerable Software and Affected Versions: Seerox Easy Blocks pro versions 1.0.0 through 1.0.21 Description: The issue is related to missing authorization, allowing access to functionality not properly constrained by Access Control Lists ACLs. This means that certain features or...

Learn How Experts Secure Privileged Accounts—Proven PAS Strategies Webinar

Cybercriminals know that privileged accounts are the keys to your kingdom. One compromised account can lead to stolen data, disrupted operations, and massive business losses. Even top organizations struggle to secure privileged accounts. Why? Traditional Privileged Access Management PAM solutions...

The vulnerability of the Flow-X gas consumption controller and processor web service allows a intruder to access confidential information.

The vulnerability of the Flow-X gas consumption controller web service is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

MediaTek Chipsets 安全漏洞

MediaTek Chipsets are a variety of chips from China's MediaTek Corporation MediaTek. A security vulnerability exists in MediaTek Chipsets, which stems from a lack of boundary checking in power, which could lead to out-of-bounds writes...

Did security gaps at Antwerp port enable drug smuggling operations?

TL;DR Why hack shipping? For profit. Criminals have been proven to have hacked port systems to bypass security and facilitate drug smuggling. Evidence of hacking? Rarely reported, but cases like MSC and Glencore’s cobalt theft and the incidents at the Port of Antwerp below provide real examples...

Online Shopping Portal dom_data_two_headers.php file cross-site scripting vulnerability

Online Shopping Portal is an online store system. Online Shopping Portal suffers from a cross-site scripting vulnerability that originates in the parameter admin/assets/plugins/DataTables/media/unittesting/templates/domdatatwoheaders.php. scripts lack effective filtering and escaping of...