XWiki Platform xwiki-platform-oldcore Unauthorized Access

The vulnerability of the xwiki-platform-oldcore module of the XWiki platform, which is used for creating collaborative web applications, exposes security flaws in access control for personal information. Exploiting this vulnerability could allow unauthorized actors to gain unauthorized access to...

XWiki Platform xwiki-platform-oldcore Unauthorized Access

The vulnerability of the xwiki-platform-oldcore module of the XWiki platform, which is used for creating collaborative web applications, exposes vulnerabilities related to access control for personal information. Exploiting this vulnerability could allow an attacker to gain unauthorized access to...

CVE-2025-54125: Exposure of Private Personal Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can b...

CVE-2025-54124: Exposure of Private Personal Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can creat...

CVE-2025-50870

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the...

Spying on People Through Airportr Luggage Delivery Service

Airportr is a service that allows passengers to have their luggage picked up, checked, and delivered to their destinations. As you might expect, it's used by wealthy or important people. So if the company's website is insecure, you'd be able to spy on lots of wealthy or important people. And mayb...

PT-2025-31656 · Unknown · Institute-Of-Current-Students

Name of the Vulnerable Software and Affected Versions: Institute-of-Current-Students version 1.0 Description: The software is susceptible to Incorrect Access Control. The mydetailsstudent.php endpoint allows unauthorized access to student details. The myds GET parameter accepts an email address a...

Prison visitor details shared with all inmates at correctional facility

The Everglades Correctional Institution ECI in Miami-Dade County has leaked the names, email addresses, and telephone numbers of visitors to the facility to every inmate. The inmates received an email last week sent by a staff member that included the personal information of the visitors. Inmates...

iPhone vs. Android: iPhone users more reckless, less protected online

The smartphone wars have a winner, and it’s Android. No, this isn’t about which device has the best camera, the snappiest processor, or the flashiest AI features—this is about which device owners are safer online, and in many ways, it is Android users who take the crown. According to a new analys...

How the Solid Protocol Restores Digital Agency

The current state of digital identity is a mess. Your personal information is scattered across hundreds of locations: social media companies, IoT companies, government agencies, websites you have accounts on, and data brokers you've never heard of. These entities collect, store, and trade your...

CVE-2025-7371

CVE-2025-7371 affects Okta On-Premises Provisioning (OPP) agents. Data logging vulnerability exists in local OPP agent servers in versions 2.2.1–2.3.0, where administrator-initiated password resets cause the agent to log user personal information and temporary passwords. Affected scenario: an att...

Okta On-Premises Provisioning Agent log information leakage vulnerability

Okta On-Premises Provisioning Agent is a software from Okta USA that automates the creation, update and deletion of Otka user accounts in a local environment. A log information disclosure vulnerability exists in Okta On-Premises Provisioning Agent version 2.3.0 and prior versions, which originate...

PhishIntentionLLM: Uncovering Phishing Website Intentions through Multi-Agent Retrieval-Augmented Generation

Phishing websites remain a major cybersecurity threat, yet existing methods primarily focus on detection, while the recognition of underlying malicious intentions remains largely unexplored. To address this gap, we propose PhishIntentionLLM, a multi-agent retrieval-augmented generation RAG...

Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai

Security researchers recently revealed that the personal information of millions of people who applied for jobs at McDonald 's was exposed after they guessed the password "123456" for the fast food chain's account at Paradox.ai , a company that makes artificial intelligence based hiring chatbots...

UK Pet Owners Targeted by Fake Microchip Renewal Scams

Microchip renewal scam targets UK pet owners using leaked data from insecure registries. Emails appear legit but aim to steal money and personal info...

Exposure of Private Personal Information to an Unauthorized Actor

Overview universal-omega/dynamic-page-list3 is a The DynamicPageList3 extension allows creating lists of other articles based on their category, namespace, title, references or template usage and include contents or arguments of template calls of those articles into your page. Affected versions o...

CVE-2025-53625: Exposure of Private Personal Information to an Unauthorized Actor

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fix...

McDonald’s AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Using the Password ‘123456’

Basic security flaws left the personal info of tens of millions of McDonald’s job-seekers vulnerable on the “McHire” site built by AI software firm Paradox.ai...

CVE-2025-53374

Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The...

CVE-2025-53374

Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The...