Two Hacks, One Empire: The Cyber Assaults Disney Didn’t See Coming

Disney was hit by two major 2024 cyberattacks, an ex-employee's sabotage and a hacker's AI trap, exposing internal…...

Century Systems FutureNet NXR和Century Systems FutureNet VXR 安全漏洞

Century Systems FutureNet NXR and Century Systems FutureNet VXR are both a series of routers from Century Systems Japan. A security vulnerability exists in Century Systems FutureNet NXR and Century Systems FutureNet VXR that stems from improper handling of symbolic link files, which could allow a...

WordPress plugin Zapier 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab Enterprise Edition EE and GitLab Community...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection over the bucket tagging endpoint. External entities referenced in a malicious XML document are resolved and retrieved. This allows attackers to expose information from internal URLs that are not meant t...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection over the bucket tagging endpoint. External entities referenced in an AccessControlPolicy XML document are resolved and retrieved. This allows attackers to perform server-side request forgery SSRF attack...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

Sucms 安全漏洞

Sucms is a completely open source and free PHP+MYSQL system by China Subianji team. A security vulnerability exists in Sucms v1.0, which stems from a server-side request forgery in the adminwebgather.php component that allows access to internal data and services...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-25760: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

AZL-57159 CVE-2025-0690 affecting package grub2 for versions less than 2.06-15

The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to...

PT-2025-7467

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description Integer overflow may lead to out-of-bounds write. Recommendations At the moment, there is no information about a newer version that contains a fix for this issue...

CVE-2024-49805

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

CVE-2024-10705

The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpgdownloadfilebylink' function. This makes it possible for authenticated attackers, with editor-level access and above, to make web...

PT-2025-1788 · WordPress · The Photo Gallery Slideshow & Masonry Tiled Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress versions up to, and including, 1.0.15 Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary...

WordPress plugin Broken Link Checker | Finder 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

PT-2024-29561 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 11.0.0 through 11.0.1 Description: The issue concerns hard-coded credentials, such as a password or cryptographic key, used by IBM Cognos Controller for inbound authentication, outbound communication to external...

CVE-2024-49806

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...