CVE-2025-40645 Exposure of sensitive information in Viday

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter...

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

...

PT-2025-40329

Name of the Vulnerable Software and Affected Versions Viday affected versions not specified Description An unauthenticated attacker can obtain sensitive customer information by sending an HTTP GET request to the /api/reserva/web/clients API endpoint. The vulnerability involves the exposure of...

Personal Identifying Information (PII) Fields Detected

This is an informational notice that the scanner was able to detect forms with fields collecting Personal Identifying Information PII data. Examples of PII data include, but are not limited to, names, email addresses, phone numbers, social security numbers, and financial information. No source da...

Beware of Zelle transfer scams

As we have said many times before, falling for a scam can happen to the best of us. And it can ruin lives. In our podcast How a scam hunter got scammed, scam hunter Julie-Anne Kearns talked about how she had been duped by people pretending to be from HMRC, which is the UK’s version of the US...

CVE-2025-5955

The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary...

CVE-2025-59715

SMSEagle before 6.11 allows reflected XSS via a username or contact phone number...

CVE-2025-10625

A vulnerability was detected in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /user/dashboard.php?page=updateprofile. The manipulation of the argument phone results in sql injection. The attack may be launched remotely. The...

CVE-2025-59715

SMSEagle before 6.11 allows reflected XSS via a username or contact phone number...

CVE-2025-59715

SMSEagle before 6.11 allows reflected XSS via a username or contact phone number...

CVE-2025-59715

SMSEagle prior to 6.11 is affected by a reflected XSS vulnerability that can be triggered via a username or a contact phone number. Affected software: SMSEagle before 6.11. Underlying cause: reflected XSS in input handling. Impact: potential client-side script execution. Exploitation details are ...

CVE-2025-59715

SMSEagle before 6.11 allows reflected XSS via a username or contact phone number...

WordPress plugin Service Finder SMS System security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2025-59715

SMSEagle before 6.11 allows reflected XSS via a username or contact phone number...

PT-2025-38506

Name of the Vulnerable Software and Affected Versions SMSEagle versions prior to 6.11 Description SMSEagle is susceptible to a reflected cross-site scripting XSS issue. The vulnerability occurs through manipulation of a username or contact phone number. Recommendations Update to version 6.11 or...

Cybercriminals Have a Weird New Way to Target You With Scam Texts

Scammers are now using “SMS blasters” to send out up to 100,000 texts per hour to phones that are tricked into thinking the devices are cell towers. Your wireless carrier is powerless to stop them...

realme Clone Phone APP 安全漏洞

realme Clone Phone APP is a data backup and recovery feature from China-based realme realme. A security vulnerability exists in realme Clone Phone APP version 15.1.122810c08250314, which stems from improper handling of the URI scheme in com.coloros.pc.PcToolMainActivity, which could lead to a cra...

CVE-2025-10625

A vulnerability was detected in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /user/dashboard.php?page=updateprofile. The manipulation of the argument phone results in sql injection. The attack may be launched remotely. The...

CVE-2025-10625 SourceCodester Online Exam Form Submission dashboard.php sql injection

A vulnerability was detected in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /user/dashboard.php?page=updateprofile. The manipulation of the argument phone results in sql injection. The attack may be launched remotely. The...

CVE-2025-10625

The CVE-2025-10625 entry concerns SourceCodester Online Exam Form Submission 1.0. A SQL injection vulnerability exists in the /user/dashboard.php?page=update_profile handler, triggered by manipulating the phone parameter (and potentially other parameters). The vulnerability is exploitable remotel...