CVE-2025-8822

creationtimestamp| type| source ---|---|--- 2025-08-11 01:31:37+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lw3nl7vzna2u 2025-08-11 02:21:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw3qenamg32s 2025-08-11 15:39:39+00:00| seen|...

CVE-2025-34152

creationtimestamp| type| source ---|---|--- 2025-08-07 20:07:56+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/46935 2025-08-08 03:00:05+00:00| published-proof-of-concept| Telegram/e2h4KF19bvVdrVdcOJim51yVXX08ZKfBey7WjVNbHEXwmTU 2025-08-09 21:02:26+00:00| seen|...

Meta slurps up EU user data for AI training

European Facebook users have so far avoided having their public posts used to train parent company Meta's AI model. That's about to change, the company has warned. In a blog post today, it said that EU residents' data was fair game and it would be slurping up public posts for training soon...

CVE-2024-13855

The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the paeglobalblock shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

WordPress plugin Prime Addons for Elementor 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An Access Control...

CVE-2024-13854

The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naeduelementortemplate shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

CERTFR-2025-ACT-002

creationtimestamp| type| source ---|---|--- 2025-01-17 16:45:05+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3lfxakzi2ev2w 2025-01-20 13:10:41+00:00| seen| https://bsky.app/profile/ag6218ent.bsky.social/post/3lg6fyfd7ww2y...

UBUNTU-CVE-2023-5692

WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirectguess404permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publiclyqueryable' post status has been set to 'false'...

DEBIAN-CVE-2023-5561

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack...

UBUNTU-CVE-2023-5561

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack...

WordPress plugin Blocksy Companion 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

An Absurdly Basic Bug Let Anyone Grab All of Parler's Data

The “free speech” social network also allowed unlimited access to every public post, image, and video...

WordPress Comment Mismanagement Vulnerability

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A comment mismanagement vulnerability exists in wp-includes/comment-template.php in WordPres...

UBUNTU-CVE-2020-25286

In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...

Testimonial Rotator < 3.0.3 - Authenticated Stored Cross-Site Scripting (XSS)

A Stored XSS vulnerability has been found in the 'Author Information' textarea in testimonials from the plugin, which could allow an authenticated medium-privileged user contributor+ to inject arbitrary JavaScript. The XSS will be triggered for anyone visiting public posts or testimonial page...

Ultimate Facebook Scraper - A Bot Which Scrapes Almost Everything About A Facebook User'S Profile Including All Public Posts/Statuses Available On The User'S Timeline, Uploaded Photos, Tagged Photos, Videos, Friends List And Their Profile Photos

Tooling that automates your social media interactions to collect posts, photos, videos, friends, followers and much more on Facebook. Features A bot which scrapes almost everything about a facebook user's profile including uploaded photos tagged photos videos friends list and their profile photos...

Cross site request forgery (csrf)

The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location...

CVE-2016-10938: Cross-Site Request Forgery (CSRF)

The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location...

A week in security (June 4 – June 10)

Last week on Labs, we took a look at hidden mobile ads, the perils of social media spam, and how to shore up your landline defenses. We also took a deep dive into Emotet malware analysis, and gave you some summertime safety tips. Other news Update your Adobe Flash player if you haven't already...