Aggregator

该漏洞是通过利用ssrf获取用户的 accessToken 进行的任意命令执行漏洞，命令执行部分与之前的默认accessToken的部分基本一致。

A vulnerability was found in BlogPHP 2.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument Username leads to cross site scripting. The identification of this vulnerability is CVE-2008-6631. The attack may be initiated remotely. Furthermore, there is an exploit available.

A critical security alert has been issued to WordPress site administrators following the discovery of two high-severity vulnerabilities in the “WP Ultimate CSV Importer” plugin. With over 20,000 active installations, the plugin’s flaws pose a significant risk to affected websites, potentially leading to complete site takeovers by attackers. CVE Identified: File Upload and Deletion Exploits […]

The post 20,000 WordPress Sites at Risk of File Upload & Deletion Exploits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The cybersecurity landscape has witnessed a concerning development with the emergence of “Prince Ransomware,” an open-source ransomware builder that was freely accessible on GitHub until recently. This tool, written in the Go programming language, has been exploited by cybercriminals to launch sophisticated ransomware attacks with minimal technical expertise. The recent attack on Mackay Memorial Hospital […]

The post Prince Ransomware – An Automated Open-Source Ransomware Builder Freely Available on GitHub appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cybersecurity researchers have identified a growing trend in phishing attacks leveraging QR codes, a tactic known as “quishing.” These attacks exploit the widespread use of smartphones to deceive users into exposing sensitive credentials, particularly targeting Microsoft accounts. According to recent findings, attackers are embedding malicious URLs within QR codes to bypass traditional security measures and […]

The post QR Code Phishing (Quishing) Attack Your Smartphones To Steal Microsoft Accounts Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability classified as critical has been found in json-c up to 0.15-20200726. Affected is the function parseit of the file json_parse.c. The manipulation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2021-32292. The attack needs to be done within the local network. There is no exploit available.

A vulnerability was found in Time Machine Plugin up to 3.4.0 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file wpTimeMachineCore.php of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability is known as CVE-2025-3097. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in Theme4Press Demo Awesome Plugin up to 1.0.3 on WordPress. It has been rated as problematic. Affected by this issue is the function install_plugin of the component Activation Handler. The manipulation leads to missing authorization. This vulnerability is handled as CVE-2024-13637. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic was found in Shopper Approved Reviews Plugin 2.0/2.1 on WordPress. This vulnerability affects the function ajax_callback_update_sa_option. The manipulation leads to missing authorization. This vulnerability was named CVE-2025-3063. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Video Url Plugin up to 1.0.0.3 on WordPress. Affected is an unknown function. The manipulation of the argument ID leads to cross site scripting. This vulnerability is traded as CVE-2025-3098. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability has been found in Smart Icons for Plugin up to 1.0.4 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the component SVG File Upload Handler. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2025-2513. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in Gift Certificate Creator Plugin up to 1.1.0 on WordPress and classified as problematic. Affected by this issue is the function receip_address. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2025-2483. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Advanced Search by My Solr Server Plugin up to 2.0.5 on WordPress. It has been classified as problematic. This affects an unknown part of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability is uniquely identified as CVE-2025-3099. It is possible to initiate the attack remotely. There is no exploit available.

Application security (AppSec) would not have existed for the past 25 years without the Common Vulnerabilities and Exposures (CVEs), the numbering system used for identifying discovered vulnerabilities in software. After the creation and adoption of the system in 1999, major companies such as Microsoft quickly began contributing CVE discoveries, using the Common Vulnerability Scoring System (CVSS) to convey the severity of a flaw. 

The post CVEs lose relevance: Get proactive — and think beyond vulnerabilities appeared first on Security Boulevard.

本系列通过真实案例剖析作恶手法，帮助行业参与者从中学习并更好地保护自己的资产。

本系列通过真实案例剖析作恶手法，帮助行业参与者从中学习并更好地保护自己的资产。

本系列通过真实案例剖析作恶手法，帮助行业参与者从中学习并更好地保护自己的资产。

本系列通过真实案例剖析作恶手法，帮助行业参与者从中学习并更好地保护自己的资产。