China Hackers Used Trojanized UyghurEditPP App to Target Uyghur Activists

China-linked hackers targeted Uyghur activists using a Trojanized UyghurEditPP app in a spear-phishing campaign, Citizen Lab researchers reveal.…...

CVE-2025-39574

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Stored XSS.This issue affects Uix Shortcodes: from n/a through = 2.0.4...

GHSA-H9W6-F932-GQ62 ses's global contour bindings leak into Compartment lexical scope

Impact Web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used const, let, and class bindings in the top-level scope of a tag will have inadvertently revealed these bindings in the lexical scope...

CVE-2025-39574

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Stored XSS.This issue affects Uix Shortcodes: from n/a through = 2.0.4...

CVE-2025-39574

CVE-2025-39574 describes a stored XSS in UIUX Lab Uix Shortcodes caused by improper input neutralization during web page generation. Affected: Uix Shortcodes versions

PT-2025-16602 · Uiux · Uiux Lab Uix Shortcodes

Name of the Vulnerable Software and Affected Versions: UIUX Lab Uix Shortcodes versions n/a through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

How to Leak to a Journalist

Neiman Lab has some good advice on how to leak a story to a journalist...

Exploit for Code Injection in Craftcms Craft_Cms

craft-cms-RCE-CVE-2024-56145 A POC lab environment for CVE-202...

WordPress Query Wrangler plugin <= 1.5.54 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Query Wrangler versions = 1.5.54...

CVE-2024-53679 Apache VCL: XSS vulnerability in User Lookup impacting user privileges

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevate...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

It is an offensive tool for web application exploitation. The re...

Israeli Spyware Graphite Targeted WhatsApp with 0-Click Exploit

Citizen Lab's investigation reveals sophisticated spyware attacks exploiting WhatsApp vulnerabilities, implicating Paragon Solutions. Learn how their research exposed these threats and the implications for digital privacy...

lab-worldwide.com Cross Site Scripting vulnerability OBB-4038228

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

One of the most notorious providers of abuse-friendly "bulletproof" web hosting for cybercriminals has started routing its operations through networks run by the Russian antivirus and security firm Kaspersky Lab , KrebsOnSecurity has learned. Security experts say the Russia-based service provider...

CVE-2025-25206 Incorrect input validation could allow an authenticated user to read sensitive information

eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if...

CVE-2025-24616

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through = 1.7.3...

CVE-2025-24616 WordPress Uix Page Builder Plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through = 1.7.3...

CVE-2025-24616

CVE-2025-24616 concerns WordPress Uix Page Builder (plugin) versions up to 1.7.3. The issue is a reflected XSS caused by improper input neutralization during web page generation. The CVE’s base metrics (CVSS 3.1) indicate Network attack vector, Low confidentiality/integrity/availability impact, a...

PT-2025-6388 · Digital China · Dcbi-Netlog-Lab Gateway

Name of the Vulnerable Software and Affected Versions: Digital China DCBI-Netlog-LAB Gateway version 1.0 Description: The issue is related to a buffer overflow vulnerability due to the lack of length verification when saving parental control configuration information. This can cause the remote...

CVE-2025-25530

Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, which is related to saving parental control configuration information. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute...