CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-57462

creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...

CVE-2025-57460

creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...

CVE-2025-57459

creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...

GHSA-6H2F-WJHF-4WJX Pyrofork has a Path Traversal in download_media Method

Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...

Pyrofork has a Path Traversal in download_media Method

Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...

CVE-2025-62993

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.5.1...

CVE-2025-65742

creationtimestamp| type| source ---|---|--- 2025-12-10 14:21:16+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/62424...

CVE-2025-49173

creationtimestamp| type| source ---|---|--- 2025-12-10 09:00:05+00:00| published-proof-of-concept| Telegram/b0MrL-7YyNVMwlRE8cQmf3aSFWZZuNk0ErN3GEJH-SnDaRk...

PT-2025-50567

Name of the Vulnerable Software and Affected Versions Pyrofork versions 2.3.68 and earlier Description Pyrofork is an asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages before using them in file path construction with...

CVE-2025-65754

creationtimestamp| type| source ---|---|--- 2025-12-09 21:00:05+00:00| published-proof-of-concept| Telegram/qJ94TH8UxM1mvjtBkVVanzfaRAufPLEJcbQaTg-CgcLSXM...

EUVD-2025-202010

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.4.7...

CVE-2025-62993

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.5.1...

CVE-2025-62993

CVE-2025-62993 concerns WordPress plugin Notification for Telegram (plugin slug: notification-for-telegram) with versions up to and including 3.4.7. The Red Hat/EUVD/NVD/NIST entries describe a Missing Authorization vulnerability (Broken Access Control) arising from incorrectly configured access ...

CVE-2025-62993 WordPress Notification for Telegram plugin <= 3.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.5.1...

CVE-2025-62993 WordPress Notification for Telegram plugin <= 3.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.5.1...

Goodbye, dark Telegram: Blocks are pushing the underground out

Telegram has won over users worldwide, and cybercriminals are no exception. While the average user chooses a messaging app based on convenience, user experience and stability and perhaps, cool stickers, cybercriminals evaluate platforms through a different lens. When it comes to anonymity, privac...

WordPress plugin Notification for Telegram 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A security...

PT-2025-50019

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.4.7...

How phishers hide banking scams behind free Cloudflare Pages

During a recent investigation, we uncovered a phishing operation that combines free hosting on developer platforms with compromised legitimate websites to build convincing banking and insurance login portals. These fake pages don't just grab a username and password–they also ask for answers to...