17806 matches found
CVE-2025-13736
When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the...
CVE-2025-13736
The CVE-2025-13736 entry describes a username enumeration issue in the login interface when Multi-Attribute Login is enabled. The vulnerability causes valid usernames to be resolved and displayed in canonical form, while non-existent usernames are echoed, enabling attackers to distinguish existin...
EUVD-2026-53721
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...
CVE-2026-71240
DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...
Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks
Passkeys were supposed to make stolen passwords a thing of the past. No password to phish, no secret to reuse, and no string of characters sitting in a database waiting to be leaked. Over time, it's thought that passkeys will replace passwords entirely. But what happens when malware steals the...
CVE-2026-71240
DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...
EUVD-2026-53313
DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...
Kali365 Exploits Microsoft Device Login to Access US Corporate Data
Learn how Kali365 has been abusing Microsoft device login to gain OAuth tokens, targeting US firms, and how SOC teams can detect, hunt, and stop these phishing attacks...
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The commercial phishing-as-a-service PhaaS toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication MFA and seiz...
CVE-2026-14219
URL redirection to untrusted site 'open redirect' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
CVE-2026-14219
URL redirection to untrusted site 'open redirect' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
EUVD-2026-52650
URL redirection to untrusted site 'open redirect' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
CVE-2026-14219 URL Redirection in Bilin Software's HUMANIST Digital Human Resources
URL redirection to untrusted site 'open redirect' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
CVE-2026-14219
CVE-2026-14219 describes an open redirect vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources, affecting versions 26.0 up to (but not including) 26.1. The issue enables redirection to an untrusted site, facilitating phishing attempts. The CVSS v3.1 ba...
WhatsApp account takeover scam asks you to “vote for my friend”
A scam is spreading through WhatsApp with the goal of taking over victims' accounts entirely. It starts with a message that feels harmless and familiar. Someone—often a contact whose account has already been compromised—asks you to support a friend or relative of theirs by voting in an online...
CVE-2026-69087
The Grav form plugin getgrav/grav-plugin-form before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect accepts external URLs without origin validation. When a form blueprint...
EUVD-2026-52280
The Grav form plugin getgrav/grav-plugin-form before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect accepts external URLs without origin validation. When a form blueprint...
CVE-2026-69087 Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig
The Grav form plugin getgrav/grav-plugin-form before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect accepts external URLs without origin validation. When a form blueprint...
CVE-2026-69087
The Grav form plugin getgrav/grav-plugin-form before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect accepts external URLs without origin validation. When a form blueprint...
An analysis of incidents at Brazilian educational institutions
Introduction Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information...