WordPress plugin Temporarily Hidden Content 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

Unveiling Usability Challenges in Web Privacy Controls

With the increasing concerns around privacy and the enforcement of data privacy laws, many websites now provide users with privacy controls. However, locating these controls can be challenging, as they are frequently hidden within multiple settings and layers. Moreover, the lack of standardizatio...

MAL-2025-6192 Malicious code in paypal-invoicing (npm)

Malicious package. Collects system info, exfiltrates data to hardcoded IP, runs code during preinstall, and attempts to hide activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd66aabb4b40f49dc7ef8bda42a33f705beb6def65601b8fd3025c7e055bc2e6 Any computer that...

TOTOLINK N300RB 8.54 Hidden Remote Support Feature

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

Firebox T15 contains an issue with hidden functionality

Overview Firebox T15 provided by WatchGuard Technologies contains the following vulnerability. Hidden functionality CWE-912 - CVE-2025-4106 Chuya Hayakawa and Ryo Kamino of 00One, Inc. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact An attacker may log...

CVE-2025-50125

A CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of host request header...

CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

CVE-2025-50125

CVE-2025-50125 affects Schneider Electric EcoStruxure IT Data Center Expert (DCE) up to version 8.3. A server-side request forgery (SSRF) vulnerability exists in the DCE web application that forwards HTTP requests based on the Host header for unauthenticated users, enabling an attacker to coerce ...

PT-2025-29226 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: Apache affected versions not specified Description: A Server-Side Request Forgery SSRF vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and...

CVE-2025-53625 DynamicPageList3 exposes hidden/suppressed usernames

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fix...

CVE-2025-53625

The CVE-2025-53625 entry concerns the DynamicPageList3 extension for MediaWiki. Several #dpl parameters can leak usernames that were hidden via revision deletion, suppression, or the hideuser block flag. The issue affects DynamicPageList3 prior to version 3.6.4 and is addressed by upgrading to 3....

CVE-2025-53625 DynamicPageList3 exposes hidden/suppressed usernames

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fix...

DynamicPageList3 vulnerability exposes hidden/suppressed usernames

Summary Several dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. Details The parameters adduser, addauthor, and addlasteditor output the page creator or last editor using the %USER% placeholder. These display the actual...

GHSA-7PGW-Q3QP-6PGQ DynamicPageList3 vulnerability exposes hidden/suppressed usernames

Summary Several dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. Details The parameters adduser, addauthor, and addlasteditor output the page creator or last editor using the %USER% placeholder. These display the actual...

DynamicPageList3 安全漏洞

DynamicPageList3 is an application by CosmicAlpha Personal Developers. A security vulnerability exists in DynamicPageList3 versions prior to 3.6.4, which stems from multiple dpl parameters that may reveal hidden usernames...

Hiding Prompt Injections in Academic Papers

Academic papers were found to contain hidden instructions to LLMs: It discovered such prompts in 17 articles, whose lead authors are affiliated with 14 institutions including Japan's Waseda University, South Korea's KAIST, China's Peking University and the National University of Singapore, as wel...

Massive Android Fraud Operations Uncovered: IconAds, Kaleidoscope, SMS Malware, NFC Scams

A mobile ad fraud operation dubbed IconAds that consisted of 352 Android apps has been disrupted, according to a new report from HUMAN. The identified apps were designed to load out-of-context ads on a user's screen and hide their icons from the device home screen launcher, making it harder for...

SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents

As Large Language Models LLMs are increasingly deployed as autonomous agents in complex and long horizon settings, it is critical to evaluate their ability to sabotage users by pursuing hidden objectives. We study the ability of frontier LLMs to evade monitoring and achieve harmful hidden goals...

CVE-2024-38524 GWC Home Page communicate version and revision information

GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPageHttpServletRequest, HttpServletResponse has no check to hide potentially sensitive information from users except for a hidden system property to hide the...

GHSA-JM79-7XHW-6F6F GWC Home Page communicate version and revision information

Summary The GeoWebCache home page includes version and revision information about the software in use. This information is sensitive from a security point of view because it allows software used by the server to be easily identified. Details...