Inquiry Cart <= 3.4.2 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make a logged in admin open an HTML file containing: alert9995'...

Search & Replace < 3.2.2 - Admin+ SQL injection

Description The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks such as within a multi-site network. PoC 1. Go to the Tools parameter 2. Select Search & Replace 3. Click "Do Search & Replace" 4. Change the...

Search & Replace < 3.2.2 - Admin+ SQL injection

Description The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks such as within a multi-site network. 1. Go to the Tools parameter 2. Select Search & Replace 3. Click "Do Search & Replace" 4. Change the parameters...

Floating Chat Widget < 3.2.3 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go "Chaty Create New Widgets 3...

Web Directory Free < 1.7.0 - Unauthenticated SQL Injection

Description The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. curl --url...

Themify Builder < 7.5.8 - Open Redirect

Description The plugin does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue curl -kvL https://www.example.com/wp-login.php \ -e http://arbitrary-referer \ -d...

CVE-2024-21006

creationtimestamp| type| source ---|---|--- 2024-05-07 12:31:14+00:00| published-proof-of-concept| https://t.me/HackingInsights/127 2024-05-09 08:33:20+00:00| published-proof-of-concept| https://t.me/CNArsenal/2447 2024-05-09 17:06:40+00:00| published-proof-of-concept|...

D-Link G416 安全漏洞

The D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 and supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection remote code execution vulnerability, which stems from a nodered chmo...

Bosch Security Systems B426 Improper Access Control (CVE-2021-23845)

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

CVE-2023-6780

creationtimestamp| type| source ---|---|--- 2024-01-31 15:21:59+00:00| seen| https://t.me/ctinow/176815 2024-01-31 15:31:42+00:00| seen| https://t.me/ctinow/176822 2024-01-31 17:00:10+00:00| seen| https://t.me/truesecator/5359 2024-02-01 08:59:09+00:00| seen|...

Active Exploitation of Two Critical Flaws in Microsoft SharePoint

Summary: Active attacks targeting a critical Microsoft SharePoint Server vulnerability CVE-2023-29357 pose a severe risk, enabling privilege escalation for potential full administrator access. This flaw, coupled with CVE-2023-24955, allows arbitrary code execution. Immediate patching is crucial, ...

Play Ransomware A Global Threat Impacting Businesses

Summary: The Play ransomware group, active since June 2022, employs a double-extortion model, impacting businesses globally. Utilizing legitimate tools for malicious activities, the group has affected approximately 300 entities. Threat Level - Red | Attack Report For a detailed threat advisory,...

june-partners.com Improper Access Control vulnerability OBB-3802230

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-32837

creationtimestamp| type| source ---|---|--- 2023-11-06 07:30:38+00:00| seen| https://t.me/cibsecurity/73569 2024-06-13 18:03:00+00:00| seen| https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html 2025-04-25 16:07:11+00:00| published-proof-of-concept|...

CVE-2023-45247

creationtimestamp| type| source ---|---|--- 2023-10-09 16:16:06+00:00| seen| https://t.me/cibsecurity/71838 2023-11-01 13:42:51+00:00| seen| https://t.me/ETHICALHACKERSCOMMUNITY2/3224 2025-06-16 17:37:50+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18478 2026-09-01 20:00:43+00:00| seen|...

CVE-2023-39141

creationtimestamp| type| source ---|---|--- 2023-08-22 22:18:09+00:00| seen| https://t.me/cibsecurity/68965 2023-08-30 02:38:36+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5034 2023-08-31 10:59:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8944...

CVE-2023-2917

creationtimestamp| type| source ---|---|--- 2023-08-17 20:37:33+00:00| seen| https://t.me/cibsecurity/68770 2025-06-04 21:56:31+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/thinmanagertraversalupload2.rb 2025-06-05 21:02:22+00:00| seen...

CVE-2023-38198

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023...

CVE-2023-38198

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023...

CISA and FBI Release Cybersecurity Advisory on Enhanced Monitoring to Detect APT Activity Targeting Outlook Online

The Cybersecurity and Infrastructure Security Agency CISA and Federal Bureau of Investigation FBI have released a joint Cybersecurity Advisory CSA, Enhanced Monitoring to Detect APT Activity Targeting Outlook Online, to provide guidance to agencies and critical infrastructure organizations on...