CVE-2025-15586: Improper Authentication

OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without knowledge of the victim account's password...

CVE-2025-14864: Missing Authorization

The Virusdie - One-click website security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.7. This is due to missing capability checks on the vdgetapikey function which is hooked to wpajaxvirusdieapikey. This makes it possible for...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE lies in the lack of measures taken to protect the website structure, allowing attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

GO-2026-4445 Sliver Vulnerable to Website Path Traversal / Arbitrary File Read (Authenticated) in github.com/bishopfox/sliver

Sliver Vulnerable to Website Path Traversal / Arbitrary File Read Authenticated in github.com/bishopfox/sliver...

CVE-2026-2032 Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS

Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1...

A week in security (February 9 – February 15)

Last week on Malwarebytes Labs: How to find and remove credential-stealing Chrome extensions Fake shops target Winter Olympics 2026 fans Outlook add-in goes rogue and steals 4,000 credentials and payment data Child exploitation, grooming, and social media addiction claims put Meta on trial Apple...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the lack of protective measures for website structures, allowing attackers to execute arbitrary code.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Azure HDInsight data analytics service, related to the lack of protective measures for website structures, allows attackers to perform spear-phishing attacks.

The vulnerability of the Azure HDInsight data analytics service is related to the lack of security measures for website structures. Exploiting this vulnerability could allow attackers to perform spear-phishing attacks remotely...

CVE-2026-20676

A flaw was found in WebKitGTK. A malicious website can track users through web extensions due to improper state management. Mitigation Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require...

📄 Xerte Online Toolkits 3.14 Template Import Shell Upload

This Metasploit module exploits an authentication bypass allowing arbitrary file upload in Xerte Online Toolkits versions 3.14 and earlier to upload and execute a shell. Specifically, this targets /websitecode/php/import/import.php. Note: this Metasploit module results in directories being create...

The vulnerability of Cisco Unified Contact Center Enterprise and Cisco Packaged Contact Center Enterprise software lies in the insufficient protection of the website structure, which allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of Cisco Unified Contact Center Enterprise and Cisco Packaged Contact Center Enterprise software lies in the insufficient protection of the website structure. Exploiting this vulnerability allows an attacker to perform cross-site scripting attacks XSS remotely...

CVE-2019-25335 PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass

PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page. Attackers can bypass authentication by using '=' 'or' as both username and password to gain unauthorized access to the administrative interface...

CVE-2019-25335

CVE-2019-25335 affects PRO-7070 Hazır Profesyonel Web Sitesi version 1.0. The vulnerability is an authentication bypass in the administration panel login page, allowing an attacker to gain unauthorized access by supplying the username and password both as = or as the string 'or'. The exploitation...

CVE-2019-25335 PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass

PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page. Attackers can bypass authentication by using '=' 'or' as both username and password to gain unauthorized access to the administrative interface...

Websitem 7070 Hazır Profesyonel Web Sitesi SQL注入漏洞

Websitem 7070 Ready-made Professional Website is a website construction kit provided by the Turkish company Websitem. Version 1.0 of Websitem 7070 Ready-made Professional Website contains a SQL injection vulnerability. This vulnerability stems from an authentication bypass in the login page of th...

Halo 安全漏洞

Halo is a powerful and easy-to-use open-source website building tool developed by Halo. Versions of Halo 2.22.4 and earlier contain security vulnerabilities. These vulnerabilities stem from defects in the public comment submission endpoint, which could allow remote attackers to trigger a...

UBUNTU-CVE-2026-20676

This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A website may be able to track users through Safari web extensions...

Apple多款产品 资源管理错误漏洞

Apple iOS is an operating system developed for mobile devices.Apple macOS is a specialized operating system developed for Mac computers.Apple iPadOS is an operating system for iPad tablets. A denial of service vulnerability exists in multiple Apple products and is caused due to an error in the...

Apple多款产品 安全漏洞

Apple iOS is an operating system developed for mobile devices.Apple macOS is a specialized operating system developed for Mac computers.Apple iPadOS is an operating system for iPad tablets. A denial of service vulnerability exists in multiple Apple products due to an error in the WebKit component...

Apple多款产品 安全漏洞

Apple iOS is an operating system developed for mobile devices.Apple macOS is a specialized operating system developed for Mac computers.Apple iPadOS is an operating system for iPad tablets. A denial of service vulnerability exists in multiple Apple products due to an error in the WebKit component...