The vulnerability of the SAP Business Warehouse data management and analytics system, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the SAP Business Warehouse data management and analytics system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2025-14071: Deserialization of Untrusted Data

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via deserialization of untrusted input in the dslcmodulepostsoutput shortcode. This makes it possible for authenticated attackers, with...

shopz---h4ck-this-website-

No d...

CVE-2023-53925

UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG files through the file management interface that execute arbitrary scripts when viewed by other users...

CVE-2025-14837

A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has bee...

CVE-2025-63390

creationtimestamp| type| source ---|---|--- 2025-12-18 15:58:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115741395287796408 2026-01-21 17:31:11+00:00| seen| https://gist.github.com/Cristliu/0897bceac5fdc2d945304b5087a84f14 2026-01-21 17:31:29+00:00| seen|...

CVE-2025-14837

A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has bee...

CVE-2025-14837: Improper Control of Generation of Code

A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has bee...

CVE-2025-14837 ZZCMS Backend Website Settings siteconfig.php stripfxg code injection

A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has bee...

EUVD-2025-203894

CSRF in Ercom Cryptobox administration console allows attacker to trigger some actions on behalf of a Cryptobox administrator. The attack requires the administrator to browse a malicious web site or to click a link while he has an open session on the administration console...

CVE-2025-14266 CSRF in Ercom Cryptobox administration console

CSRF in Ercom Cryptobox administration console allows attacker to trigger some actions on behalf of a Cryptobox administrator. The attack requires the administrator to browse a malicious web site or to click a link while he has an open session on the administration console...

webkitgtk: A website may exfiltrate image data cross-origin

A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches...

webkitgtk: A website may exfiltrate image data cross-origin

A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches...

The vulnerability of the industrial network access point Wi-Fi model from Rockwell Automation, model 1783-NATR, arises from the lack of protective measures for the website structure. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Wi-Fi network access point from Rockwell Automation model 1783-NATR is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of Schneider Electric’s ATV, ILC, VW series software products stems from the lack of protective measures for the website structure, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Schneider Electric’s ATV, ILC, and VW series software products is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Logendpoint component of the Splunk Enterprise platform for operational analysis lies in the redirection of the URL to an unreliable website, allowing a hacker to redirect users to any given URL address.

The vulnerability of the Logendpoint component of the Splunk Enterprise platform for operational analysis is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability could allow a malicious actor to redirect users to any given URL address...

CVE-2025-13537: Improper Neutralization of Input During Web Page Generation

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to multiple Stored Cross-Site Scripting vulnerabilities via DOM manipulation in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Th...

Malicious Package

Overview react-vis-website is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview test-website-hashroute is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Most Parked Domains Now Serving Malicious Content

Direct navigation -- the act of visiting a website by manually typing a domain name in a web browser -- has never been riskier: A new study finds the vast majority of "parked" domains -- mostly expired or dormant domain names, or common misspellings of popular websites -- are now configured to...