⚡ Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More

Power doesn't just disappear in one big breach. It slips away in the small stuff—a patch that's missed, a setting that's wrong, a system no one is watching. Security usually doesn't fail all at once; it breaks slowly, then suddenly. Staying safe isn't about knowing everything—it's about acting fa...

Malicious code in payments-quickstart (npm)

The package payments-quickstart was found to contain malicious code...

Malicious code in shopify-payments-terms (npm)

The package shopify-payments-terms was found to contain malicious code...

MAL-2025-28154 Malicious code in offsite_payments (npm)

The package offsitepayments was found to contain malicious code...

MAL-2025-28945 Malicious code in payments-quickstart (npm)

The package payments-quickstart was found to contain malicious code...

MAL-2025-14212 Malicious code in airwallex-online-payments-gateway (npm)

The package airwallex-online-payments-gateway was found to contain malicious code...

Malicious code in airwallex-online-payments-gateway (npm)

The package airwallex-online-payments-gateway was found to contain malicious code...

MAL-2025-33134 Malicious code in shopify-payments-terms (npm)

The package shopify-payments-terms was found to contain malicious code...

MAL-2025-33133 Malicious code in shopify-payments-configuration (npm)

The package shopify-payments-configuration was found to contain malicious code...

Malicious code in shopify-payments-configuration (npm)

The package shopify-payments-configuration was found to contain malicious code...

GIS GMPl Web Interface Unauthorized Access

The vulnerability of the web interface of the information system for state and municipal payments in the Republic of Tatarstan GIS GMPl is related to errors in the logic of the web application’s operation. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthoriz...

AI Tools Fuel Brazilian Phishing Scam While Efimer Trojan Steals Crypto from 5,000 Victims

Cybersecurity researchers are drawing attention to a new campaign that's using legitimate generative artificial intelligence AI-powered website building tools like DeepSite AI and BlackBox AI to create replica phishing pages mimicking Brazilian government agencies as part of a financially motivat...

AI Tools Fuel Brazilian Phishing Scam While Efimer Trojan Steals Crypto from 5,000 Victims

Cybersecurity researchers are drawing attention to a new campaign that's using legitimate generative artificial intelligence AI-powered website building tools like DeepSite AI and BlackBox AI to create replica phishing pages mimicking Brazilian government agencies as part of a financially motivat...

CVE-2025-7653

The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress EPay.bg Payments plugin <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin EPay.bg Payments versions = 0.1...

CVE-2025-7653 EPay.bg Payments <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-7653

CVE-2025-7653 describes a stored XSS in the WordPress EPay.bg Payments plugin (versions

CVE-2025-7653 EPay.bg Payments <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-7653: Improper Neutralization of Input During Web Page Generation

The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress plugin EPay.bg Payments has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...