PT-2025-17831 · Unknown · Stressfree Sites Business Contact Widget

Name of the Vulnerable Software and Affected Versions: StressFree Sites Business Contact Widget versions n/a through 2.7.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that...

SUSE-SU-2025:20197-1 Security update for git

This update for git fixes the following issues: - CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites bsc1235600. - CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers bsc1235601...

Security update for git

This update for git fixes the following issues: CVE-2024-50349: Passwords for trusted sites could be sent to untrusted sites bsc1235600. CVE-2024-52006: Carriage Returns via the credential protocol to credential helpers bsc1235601. Patch Instructions: To install this SUSE update use the SUSE...

Phishers Exploit Google Sites and DKIM Replay to Send Signed Emails, Steal Credentials

In what has been described as an "extremely sophisticated phishing attack," threat actors have leveraged an uncommon approach that allowed bogus emails to be sent via Google's infrastructure and redirect message recipients to fraudulent sites that harvest their credentials. "The first thing to no...

WordPress plugin Listdom 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation...

100,000 WordPress Sites Affected by Administrative User Creation Vulnerability in SureTriggers WordPress Plugin

📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

PT-2025-15910

Name of the Vulnerable Software and Affected Versions OttoKit formerly SureTriggers versions 1.0.0 through 1.0.78 Description The vulnerability is related to an authentication bypass issue in the OttoKit WordPress plugin, which allows unauthenticated attackers to create administrator accounts on...

WordPress plugin Ultimate WP Mail 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation...

WordPress plugin WebinarPress 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation...

2025 Ransomware: Business as Usual, Business is Booming

Getting an edge on your adversaries involves understanding their behaviors and their mindset. Rapid7 Labs took a look at internal and publicly-available ransomware data for Q1 2025 and added our own insights to provide a picture of the year thus far—and what you can do now to reduce your attack...

50,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Uncanny Automator WordPress Plugin

📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

EulerOS 2.0 SP13 : git (EulerOS-SA-2025-1332)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full...

Russian Phishing Uses Fake CIA Sites to Target Anti-war, Ukraine Supporters

The phishing campaign is highly sophisticated!...

WordPress plugin Automation By Autonami 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

CVE-2025-2770

creationtimestamp| type| source ---|---|--- 2025-03-25 04:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-186/ 2025-04-23 18:00:01+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114388579201738740 2025-04-23 21:10:23+00:00| seen| https://t.me/cvedetector/23604...

GHSA-77CJ-RV5X-V6R2 FastChat open redirect vulnerability

An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft...

CVE-2024-9308

An open redirect vulnerability in haotian-liu/llava version v1.2.0 LLaVA-1.6 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft...

CVE-2025-2495 Stored Cross-Site Scripting (XSS) vulnerability in Softdial Contact Center

Stored Cross-Site Scripting XSS in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the server with JavaScript code injected via the ‘/softdial/scheduler/save.php’ resource. The injected code will execute when the uploaded file is loaded via the...

WordPress Munk Sites 1.0.7 Cross Site Request Forgery

WordPress Munk Sites plugin versions 1.0.7 and below suffer from a cross site request forgery vulnerability that allows an adversary to trick an admin into installing arbitrary plugins. 🚀 CVE-2025-25101 - WordPress Munk Sites Plugin = 1.0.7 - CSRF to Arbitrary Plugin Installation 📌 Overview...

PT-2025-11223

Name of the Vulnerable Software and Affected Versions Post SMTP versions prior to 3.3.0 Description A flaw exists in the Post SMTP WordPress plugin due to a broken access control mechanism within its REST API. This allows users with low privileges, such as Subscribers, to access sensitive email...