Lucene search
+L

76514 matches found

The Hacker News
The Hacker News
added 15 minutes ago0 views

Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale POS terminal reads over near-field communication NFC, without breaking any of the card...

SaveExploits0
The Hacker News
The Hacker News
added 50 minutes ago2 views

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic...

6.1AI score
SaveExploits0
The Hacker News
The Hacker News
added 1 hour ago2 views

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain,...

9.8CVSS6.8AI score0.00408EPSS
SaveExploits0
The Hacker News
The Hacker News
added 1 hour ago2 views

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Cybersecurity researchers have shed light on an updated version of ToxicPanda aka TgToxic that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features...

6.1AI score
SaveExploits0
NCSC
NCSC
added 3 hours ago4 views

Vulnerabilities are hidden in Zabbix

Zabbix SIA has identified several vulnerabilities in Zabbix, including the API, frontend, script items, preprocessing components, and the Windows Agent installer. These vulnerabilities affect various aspects of Zabbix. - A problem with the login lockout mechanism causes multiple simultaneous fail...

8.5CVSS5.2AI score0.00298EPSS
SaveExploits0References11
GithubExploit
GithubExploit
added 7 hours ago6 views

Awesome-Bug-Bounty-Tools-Contents

Awesome-Bug-Bounty-Tools-Contents A comprehensive Bug Bounty a...

6.3AI score
SaveExploits0
GithubExploit
GithubExploit
added 7 hours ago13 views

Exploit for CVE-2026-8181

💥 CVE-2026-8181 - Burst Statistics Authentication Bypass...

9.8CVSS5.5AI score0.14608EPSS
SaveExploits12
Nuclei
Nuclei
added 7 hours ago5 views

DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update

DynamiApps Frontend Admin plugin for WordPress .= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data. id:...

9.8CVSS5.2AI score0.02063EPSS
SaveExploits2References4
Nuclei
Nuclei
added 7 hours ago41 views

Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting

Lantronix SecureLinx Spider SLS 2.2+ devices have XSS in the auth.asp login page. id: CVE-2018-10383 info: name: Lantronix SecureLinx Spider SLS 2.2+ - Cross-Site Scripting author: ritikchaddha severity: medium description: | Lantronix SecureLinx Spider SLS 2.2+ devices have XSS in the auth.asp...

6.1CVSS6AI score0.01912EPSS
SaveExploits0References2
Nuclei
Nuclei
added 7 hours ago49 views

WordPress FlatPM <3.0.13 - Cross-Site Scripting

WordPress FlatPM plugin before 3.0.13 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape certain parameters before outputting them back in pages, which can be exploited against high privilege users such as admin. An attacker can steal cookie-based authenticatio...

5.4CVSS5.2AI score0.00869EPSS
SaveExploits2References5
Nuclei
Nuclei
added 7 hours ago58 views

WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting

The Wordpress plugin WooCommerce PDF Invoices & Packing Slips before 2.10.5 does not escape the tab and section parameters before reflecting it an attribute, leading to a reflected cross-site scripting in the admin dashboard. id: CVE-2021-24991 info: name: WooCommerce PDF Invoices & Packing Slips...

4.8CVSS4.8AI score0.01188EPSS
SaveExploits3References4
Nuclei
Nuclei
added 7 hours ago66 views

IceWarp Mail Server <=10.4.4 - Local File Inclusion

IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal. id: CVE-2019-12593 info: name: IceWarp Mail Server =10.4.4 - Local File Inclusion author: pikpikcu severity: high description: | IceWarp Ma...

7.5CVSS7.3AI score0.40965EPSS
SaveExploits5References5
Nuclei
Nuclei
added 7 hours ago58 views

WordPress Yuzo <5.12.94 - Cross-Site Scripting

WordPress Yuzo Related Posts plugin before 5.12.94 is vulnerable to cross-site scripting because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can consequently inje...

6.1CVSS5.9AI score0.05331EPSS
SaveExploits1References5
Nuclei
Nuclei
added 7 hours ago132 views

NeDi 1.9C - Cross-Site Scripting

NeDi 1.9C is vulnerable to cross-site scripting because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a...

6.1CVSS5.7AI score0.03442EPSS
SaveExploits0References4
Nuclei
Nuclei
added 7 hours ago100 views

WordPress NewStatPress <1.3.6 - Cross-Site Scripting

WordPress NewStatPress plugin before 1.3.6 is susceptible to cross-site scripting. The plugin does not properly escape the whatX parameters before outputting them back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site...

6.1CVSS5.6AI score0.01458EPSS
SaveExploits2References4
Nuclei
Nuclei
added 7 hours ago144 views

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

6.1CVSS6AI score0.10358EPSS
SaveExploits5References5
Nuclei
Nuclei
added 7 hours ago29 views

Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

10CVSS8.1AI score0.60348EPSS
SaveExploits1References5
Nuclei
Nuclei
added 7 hours ago42 views

Microweber <1.2.15 - Cross-Site Scripting

Microweber prior to 1.2.15 contains a reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch oth...

6.3CVSS6.4AI score0.03258EPSS
SaveExploits1References5
Nuclei
Nuclei
added 7 hours ago72 views

WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting

WordPress Related Posts plugin prior to 2.1.3 contains a cross-site scripting vulnerability in the rp4wpheadingtext parameter. User input is not properly sanitized, allowing the insertion of arbitrary code that can allow an attacker to steal cookie-based authentication credentials and launch othe...

5.5CVSS5.6AI score0.0119EPSS
SaveExploits1References5
Nuclei
Nuclei
added 7 hours ago94 views

Prismatic < 2.8 - Cross-Site Scripting

The plugin does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator id: CVE-2021-24409 info: name: Prismatic 2.8 - Cross-Site Scripting author: Harsh...

6.1CVSS6AI score0.01793EPSS
SaveExploits2References2
Rows per page
Query Builder