1,000+ web shops infected by “Phish ‘n Ships” criminals who create fake product listings for in-demand products

Researchers at the Satori Threat Intelligence and Research team have published their findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listings. The threat, dubbed "Phish ‘n Ships" by the researchers, reportedly infected more than 1,000...

Cross-site Scripting (XSS)

Overview feast is a Python SDK for Feast Affected versions of this package are vulnerable to Cross-site Scripting XSS in Jinja2 Environment. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The...

Doctor Appointment Management System Cross-Site Scripting Vulnerability (CNVD-2025-21427)

Doctor Appointment Management System is a doctor appointment management system. Doctor Appointment Management System suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an...

WordPress Hoo Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab Patchstack Alliance in WordPress Plugin Hoo Addons for Elementor versions = 1.0.6...

CVE-2024-49645

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ilias Gomatos Affiliate Platform allows Reflected XSS.This issue affects Affiliate Platform: from n/a through 1.4.8...

The vulnerability of the links.php script in the Cacti network monitoring software allows a hacker to perform cross-site scripting attacks.

The vulnerability of the links.php script in the Cacti network monitoring software is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

WordPress plugin Arconix Shortcodes 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform, related to the lack of protective measures for the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2024-47486

There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data...

Why Modern Layer 7 DDoS Protections Are Crucial for Web Security in 2024

A new Akamai white paper explains why you need to prioritize modern Layer 7 DDoS protection — and details how you can guide your security efforts...

GPT Academic 安全漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited ...

UBUNTU-CVE-2024-10004

Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon showing an HTTPS indicator incorrectly This vulnerability affects Firefox for iOS 131.2...

CVE-2024-41344

A Cross-Site Request Forgery CSRF in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges...

GHSA-2234-FMW7-43WR Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Summary Bypass CSRF Middleware by a request without Content-Type herader. Details Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe...

PT-2024-9767

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 131.2 Firefox iOS affected versions not specified, but versions under 131.2 are known to be affected Description: The issue is related to the incorrect display of HTTPS indicators in the Firefox browser for...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially crafte...

IncidentReporting 安全漏洞

IncidentReporting is an open source MediaWiki-based incident reporting form from Miraheze. IncidentReporting has a security vulnerability that stems from various cross-site scripting issues...

New Case Study: The Evil Twin Checkout Page

Is your store at risk? Discover how an innovative web security solution saved one global online retailer and its unsuspecting customers from an "evil twin" disaster. Read the full real-life case study here. The Invisible Threat in Online Shopping When is a checkout page, not a checkout page? When...

PhpSpreadsheet 跨站脚本漏洞

PhpSpreadsheet is an open source PHP library from PHPOffice for reading and writing spreadsheet files. A cross-site scripting vulnerability exists in PhpSpreadsheet that stems from improper handling of input...

SeedDMS 跨站脚本漏洞

SeedDMS is SeedDMS open source PHP and MySql based on a set of open source document management system . The system is mainly used to store and share documents . SeedDMS v6.0.28 version of the existence of cross-site scripting vulnerability , the vulnerability stems from the application of the...