CrocoTime employee working time management system Code Execution

The vulnerability in the CrocoTime employee working hours tracking system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CrocoTime employee working time management system Code Execution

The vulnerability in the CrocoTime employee working hours tracking system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

WOPI XSS

The vulnerability of the WOPI protocol implementation in the ONLYOFFICE Docs online package DocumentServer is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by sending specially...

Dell Storage Manager XSS

The vulnerability of Dell Storage Manager’s cluster management software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

GitLab Website Access

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to a user’s account...

an-website (>=22.5.13, <=25.6.0), drift-jit-proxy (>=0.1.0, <=0.1.6) +39 more potentially affected by CVE-2025-48945 via pycares (>=4.0.0, <=4.8.0)

pycares PYPI version =4.0.0, =22.5.13, =0.1.0, =0.6.35, =2.0.0, =5.0.0.0, =5.0.0.0, =5.0.0.0, =5.0.0.0, =5.0.0.0, =5.0.0.0, =5.0.0.0, =5.0.0.0, =5.0.0.0, =5.1.0.0 and more Source cves: CVE-2025-48945 Source advisory: OSV:GHSA-5QPG-RH4J-QP35...

HAMASTAR Technology WIMP website co-construction management platform SQL注入漏洞

HAMASTAR Technology WIMP website co-construction management platform is a management platform of HAMASTAR Technology Taiwan, China. A SQL injection vulnerability exists in the HAMASTAR Technology WIMP website co-construction management platform, which is vulnerable to SQL injection attacks...

CVE-2025-6169: Improper Neutralization of Special Elements used in an SQL Command

The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

BI Workspace XSS

The vulnerability of the BI Workspace component of the SAP BusinessObjects Business Intelligence platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month

Cybersecurity researchers are calling attention to a "large-scale campaign" that has been observed compromising legitimate websites with malicious JavaScript injections. According to Palo Alto Networks Unit 42, these malicious injects are obfuscated using JSFuck, which refers to an "esoteric and...

Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month

Cybersecurity researchers are calling attention to a "large-scale campaign" that has been observed compromising legitimate websites with malicious JavaScript injections. According to Palo Alto Networks Unit 42, these malicious injects are obfuscated using JSFuck, which refers to an "esoteric and...

WordPress Recover Abandoned Cart for WooCommerce SQL Injection Vulnerability

WordPress Recover Abandoned Cart for WooCommerce is a plugin designed to recover unfinished orders in WooCommerce. A SQL injection vulnerability exists in WordPress Recover Abandoned Cart for WooCommerce. The vulnerability stems from improper neutralization of special elements. An attacker can...

Cisco Webex XSS

The vulnerability of the Cisco Webex web conferencing platform exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Cisco Webex XSS

The vulnerability of the Cisco Webex web conferencing platform exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2025-3076

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttontext’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Element Pack Pro plugin Improper Access Control Vulnerability

WordPress Element Pack Pro plugin is a WordPress editor plugin extension plugin that is mainly used to enhance and extend the functionality and design capabilities of WordPress websites. WordPress Element Pack Pro plugin suffers from an Improper Access Control vulnerability that stems from improp...

Malicious code in tim-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50e297c0a9f986b2fbafcdfd60d41c5da7141d50b7145f69606f92ca4423f00f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in tim-website

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-3076: Improper Neutralization of Input During Web Page Generation

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttontext’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Navigating Cookie Consent Violations across the Globe

Online services provide users with cookie banners to accept/reject the cookies placed on their web browsers. Despite the increased adoption of cookie banners, little has been done to ensure that cookie consent is compliant with privacy laws around the globe. Prior studies have found that cookies...