Malicious code in loyalty-extension (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47686 Malicious code in loyalty-extension (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41498 Malicious code in @twork-data-services/loyalty-program-names (npm)

--- -= Per source details. Do not edit below this line.=-...

NSA Chief Ousted Amid Trump Loyalty Firing Spree

Plus: Another DOGE operative allegedly has a history in the hacking world, and Donald Trump’s national security adviser apparently had way more Signal chats than previously known...

MAL-2025-2814 Malicious code in @uniqa/customer-loyalty-ms-api (npm)

--- -= Per source details. Do not edit below this line.=-...

Friday Squid Blogging: Squid Loyalty Cards

Squid is a loyalty card platform in Ireland. Blog moderation policy...

eCommerce Customer Service Tips For Online Support: The Basics

Strong eCommerce customer service builds trust, boosts loyalty, and drives sales. Learn key strategies, best practices, and tools to enhance online support...

OAuth Redirect Flaw in Airline Travel Integration Exposes Millions to Account Hijacking

Cybersecurity researchers have disclosed details of a now-patched account takeover vulnerability affecting a popular online travel service for hotel and car rentals. "By exploiting this flaw, attackers can gain unauthorized access to any user’s account within the system, effectively allowing them...

CVE-2024-10187

CVE-2024-10187 affects the WordPress plugin myCred – Points Management System (Gamification). It enables Stored Cross-Site Scripting via the mycred_link shortcode due to insufficient input sanitization and output escaping on user-supplied attributes, affecting all versions up to 2.7.4. An attacke...

CVE-2024-8658 myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

Dan Solove on Privacy Regulation

Law professor Dan Solove has a new article on privacy regulation. In his email to me, he writes: "I’ve been pondering privacy consent for more than a decade, and I think I finally made a breakthrough with this article." His mini-abstract: In this Article I argue that most of the time, privacy...

CVE-2023-48926

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

Code injection

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The program offers multiple payment methods, SMS alerts and product image zoom. A security vulnerability exists in PrestaShop Advanced Loyalty Program: Loyalty Points prior to v2.3.4, which originated fro...

CVE-2023-48926

An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status...

CVE-2023-48926

CVE-2023-48926 affects the PrestaShop extension: 202 ecommerce Advanced Loyalty Program, Loyalty Points before v2.3.4. The vulnerability allows unauthenticated attackers to arbitrarily change an order status. Documents cite a CVSS v3.1 base score of 5.3 (Medium) with impact limited to integrity. ...

CVE-2023-47853

CVE-2023-47853 is a Stored XSS in the WordPress plugin myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin. The vulnerability stems from improper neutralization of input during web page generation, enabling attackers to inject scripts. Affected versions are up to 2.6.1; the iss...

Globally Used Points.com Loyalty System Hacked for Good

By Habiba Rashid Cybersecurity researcher Sam Curry and his team managed to hack Points.com before malicious threat actors could. This is a post from HackRead.com Read the original post: Globally Used Points.com Loyalty System Hacked for Good...

myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin < 2.5.1 - Cross-Site Request Forgery

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

The Anatomy of a Scalping Bot: NSB Was Copped!

In recent years, scalping bots have become a growing concern for online retailers. In this two-part blog series, we will analyze the inner workings of the Nike Shoe Bot NSB scalping bot, one of the most dangerous scalping bots around. We will take a closer look at the components of NSB, how we...