CVE-2025-15244: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race condition. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is said to be...

A week in security (December 15 – December 21)

Last week on Malwarebytes Labs: CISA warns ASUS Live Update backdoor is still exploitable, seven years on The ghosts of WhatsApp: How GhostPairing hijacks accounts Chrome extension slurps up AI chats after users installed it for privacy Two Chrome flaws could be triggered by simply browsing the...

Inside a purchase order PDF phishing campaign

A PDF named "NEW Purchase Order 52177236.pdf" turned out to be a phishing lure. So we analyzed the phishing script behind it. A customer contacted me when Malwarebytes blocked the link inside a “purchase order” email they had received. Malwarebytes blocked this ionoscloud.com subdomain When I...

CVE-2025-13987

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'suppthandledeletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2025-13987 Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'suppthandledeletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

EUVD-2025-202968

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'suppthandledeletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2025-13987

CVE-2025-13987 affects the WordPress plugin Purchase and Expense Manager up to version 1.1.2. The issue is a Cross-Site Request Forgery (CSRF) due to missing nonce validation in the function sup_pt_handle_deletion . This allows unauthenticated attackers to delete arbitrary purchase records by tri...

CVE-2025-13987 Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'suppthandledeletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

WordPress plugin Purchase and Expense Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A cross-site request...

PT-2025-50841

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'sup pt handle deletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2025-13987: Cross-Site Request Forgery (CSRF)

The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'suppthandledeletion' function. This makes it possible for unauthenticated attackers to delete arbitrary...

WordPress Purchase and Expense Manager plugin <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Purchase Record Deletion vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Purchase and Expense Manager versions = 1.1.2...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-198841

Malicious code in capacitor-plugin-purchase npm...

Malicious code in capacitor-plugin-purchase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ff438ebca922d9d6cb6a8a96700003065dbfc0ed65a5984edec2d5f5d37751 The package capacitor-plugin-purchase was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190836 Malicious code in capacitor-plugin-purchase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ff438ebca922d9d6cb6a8a96700003065dbfc0ed65a5984edec2d5f5d37751 The package capacitor-plugin-purchase was found to contain malicious code. Source: ghsa-malware...

Malicious code in capacitor-purchase-history (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ef54df7bce3add5d55de2f91510b75ffc757c47626010c4f44b59ef8f08242c The package capacitor-purchase-history was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198736

Malicious code in capacitor-purchase-history npm...

MAL-2025-190766 Malicious code in capacitor-purchase-history (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ef54df7bce3add5d55de2f91510b75ffc757c47626010c4f44b59ef8f08242c The package capacitor-purchase-history was found to contain malicious code. Source: ghsa-malware...

PT-2025-47284

Name of the Vulnerable Software and Affected Versions Live sales notification for WooCommerce plugin for WordPress versions prior to 2.3.39 Description The Live sales notification for WooCommerce plugin for WordPress is affected by a missing authorization issue. The getOrders function does not ha...