Aggregator

横河電機製FAST/TOOLSには、複数の脆弱性が存在します。

An adversary successfully infiltrated an Amazon Web Services cloud environment, escalating to full administrative privileges in a mere

The post The 8-Minute Admin: How AI-Powered “LLMjacking” Crushed AWS Defenses in Record Time appeared first on Penetration Testing Tools.

美剧《绝命毒师》讲述了高中化学教师 Walter White 在诊断癌症以及家庭经济状况岌岌可危的情况下变成毒枭的故事。但绝命毒师效应在现实中真的存在吗？根据发表在《American Economic Journal: Applied Economics》期刊上的一项研究，经济学家分析了来自丹麦的数据集，发现癌症诊断会使犯罪概率增加约 14%。研究针对了 1980 -2018 年间被诊断癌症的 368,317 名患者，组合健康记录与犯罪登记记录，研究人员跟踪了这些癌症患者的犯罪行为，并与正常人群进行对照。分析显示，在诊断癌症第一年，犯罪概率实际上下降了，研究人员指出这符合直觉，因为化疗和放疗都是非常痛苦的生理过程。但在确诊两年后，犯罪概率显著上升，这一效应能持续逾十年。研究发现，癌症会使无违法记录的人首次触犯法律。丹麦有覆盖全国的免费全民医保，在没有全民医保的国家癌症带来的冲击将会更痛苦。研究还发现，犯罪活动的增加主要由男性驱动。

Security analysts at ReliaQuest have unmasked a sophisticated phishing campaign wherein adversaries secrete remote access mechanisms within an

The post The Fatal Screensaver: ReliaQuest Unmasks Phishing That Uses .scr Files to Decapitate EDR appeared first on Penetration Testing Tools.

2026年1月，威胁猎人捕获恶意手机号559万余例，首次出现的恶意手机号289万余例，新增恶意手机号整体占比为 51.70%。

A vulnerability identified as problematic has been detected in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the file /admin/announcement/index.php?view=add of the component Announcement Management Module. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2026-2156. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability marked as critical has been reported in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation of the argument Username results in sql injection. This vulnerability is cataloged as CVE-2026-2158. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability described as problematic has been identified in SourceCodester Simple Responsive Tourism Website 1.0. Affected is an unknown function of the file /tourism/classes/Master.php?f=register of the component Registration. Executing a manipulation of the argument firstname/lastname/username can lead to cross site scripting. This vulnerability is registered as CVE-2026-2159. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability classified as problematic has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Master.php?f=save_package. The manipulation of the argument Title leads to cross site scripting. This vulnerability is documented as CVE-2026-2160. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability classified as critical was found in itsourcecode Directory Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/forget-password.php. The manipulation of the argument email results in sql injection. This vulnerability is reported as CVE-2026-2161. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability, which was classified as critical, has been found in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the argument pagetitle causes sql injection. This vulnerability appears as CVE-2026-2162. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability, which was classified as critical, was found in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2026-2163. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in detronetdip E-commerce 1.0.0 and classified as critical. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. This vulnerability is handled as CVE-2026-2165. The attack can be executed remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

新榜单纳入软件供应链故障与异常处理不当，而失效的访问控制蝉联最大风险。

A vulnerability was found in D-Link DAR-7000. It has been classified as critical. Affected is an unknown function of the file /log/mailrecvview.php. Performing a manipulation results in sql injection. This vulnerability was named CVE-2023-44694. The attack needs to be approached within the local network. There is no available exploit.

A vulnerability categorized as problematic has been discovered in fin Student Management System 1.0. This impacts an unknown function of the file profile.php. Executing a manipulation of the argument email can lead to cross site scripting. This vulnerability appears as CVE-2023-44753. The attack may be performed from remote. There is no available exploit.

A vulnerability described as critical has been identified in Student Study Center Desk Management 1.0. This affects an unknown part of the file /php-sscdms/admin/login.php of the component GET Request Handler. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2023-44752. The attack can be launched remotely. No exploit exists.

A vulnerability was found in Sacco Management system 1.0. It has been rated as critical. This affects an unknown function of the file /sacco/ajax.php. Performing a manipulation of the argument Password results in sql injection. This vulnerability is reported as CVE-2023-44755. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability has been found in D-Link DAR-7000 V31R02B1413C and classified as critical. This affects an unknown function of the file /importexport.php. This manipulation causes sql injection. This vulnerability is handled as CVE-2023-44693. The attack can only be done within the local network. There is not any exploit available.

A vulnerability described as critical has been identified in WebM Project libvpx up to 1.13.0. The affected element is an unknown function of the file vp9/encoder/vp9_encoder.c of the component VP9. Executing a manipulation can lead to memory corruption. The identification of this vulnerability is CVE-2023-44488. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.