New Research: The State of Web Exposure 2025

Are your websites leaking sensitive data? New research reveals that 45% of third-party apps access user info without proper authorization, and 53% of risk exposures in Retail are due to the excessive use of tracking tools. Learn how to uncover and mitigate these hidden threats and risks—download...

IBM CICS TX Advanced Cross-Site Scripting Vulnerability (CNVD-2025-02532)

IBM CICS TX Advanced is a transaction processing monitoring system from International Business Machines IBM for running large-scale, high-transaction-volume applications in enterprise environments. IBM CICS TX Advanced suffers from a cross-site scripting vulnerability that stems from the...

PT-2025-5098 · Unknown +1 · Buddypress +1

Name of the Vulnerable Software and Affected Versions: Eliott Robson Mass Messaging in BuddyPress versions n/a through 2.2.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means an attacke...

PT-2025-5039

Name of the Vulnerable Software and Affected Versions Jet Skinner for BuddyPress versions 1.2.5 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows Reflected XSS. This means an attacker can inject malicious scripts into a...

MAL-2025-619 Malicious code in secure-toolbots (npm)

This package contains a multi-functional infostealer malware which establishes C2 via Discord, exfiltrating sensitive user data and files and providing remote shell access to an attacker. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware...

CVE-2024-13230

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-55504

An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploitcombined.dylib component on MacOS...

PT-2025-1392 · Mercedes Benz · Ntg 6

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG 6 affected versions not specified Description: An issue exists in the user data import/export function of NTG 6 head units, where a possible integer overflow can occur. To exploit this, an attacker needs local access to the...

CVE-2025-0318 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.9.1 through different error messages in the responses. This makes it possible for...

CVE-2024-12637

The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality. The JSON files are stored in predictable locations with guessable file names when exporting user data. This could allow unauthenticated...

CVE-2024-12637 Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure

The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality. The JSON files are stored in predictable locations with guessable file names when exporting user data. This could allow unauthenticated...

CVE-2024-12637

Public technical details about CVE-2024-12637 are not provided in the Connected documents. The Initial Description notes Sensitive Information Exposure via export in Moving Users (WordPress) up to v1.05, but no further technical specifics or patches are included here.

CVE-2024-12637 Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure

The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality. The JSON files are stored in predictable locations with guessable file names when exporting user data. This could allow unauthenticated...

European Privacy Group Sues TikTok and AliExpress for Illicit Data Transfers to China

Austrian privacy non-profit None of Your Business noyb has filed complaints accusing companies like TikTok, AliExpress, SHEIN, Temu, WeChat, and Xiaomi of violating data protection regulations in the European Union by unlawfully transferring users' data to China. The advocacy group is seeking an...

PT-2025-1198 · Mercedes Benz · Ntg 6 +1

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG New Telematics Generation 6 Description: A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. Wit...

WAVLINK AC3000 Cross-Site Scripting Vulnerability

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. A cross-site scripting vulnerability exists in the WAVLINK AC3000, which stems from the lack of effective filtering and escaping of user-supplied data in the login.cgi setlangCountryCode function, for which no detailed vulnerability...

Exploit for Insertion of Sensitive Information Into Sent Data in Cern Indico

CVE-2024-50633 🏆 - CVE-2024-50633: Indico BOLA Vuln...

Selesta Visual Access Manager Cross-Site Scripting Vulnerability

Selesta Visual Access Manager is a visual access manager from Selesta. A cross-site scripting vulnerability exists in Selesta Visual Access Manager, which stems from the application's lack of effective filtering and escaping of user-supplied data, and for which no detailed vulnerability details a...

Microsoft Edge Access Control Error Vulnerability

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. Microsoft Edge Chromium-based suffers from an elevation of privilege vulnerability, which can be exploited by attackers to access sensitive user data when visiting specially crafted...

macOS 14.x < 14.5 Multiple Vulnerabilities (120903)

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.5. It is, therefore, affected by multiple vulnerabilities: - The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, macOS Ventura 13.6.7, iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and...