Aggregator

作者发现一个身份验证绕过漏洞，通过修改电子邮件后缀成功注册并获得管理员权限，导致敏感数据泄露和系统控制权获取。漏洞已修复，并强调了输入验证和API保护的重要性。

Cloudflare推出AI爬虫红黑榜，评估六家AI公司爬虫表现。OpenAI排名最高，字节跳动、Anthropic和xAI垫底。榜单将收录更多爬虫并评分。

文章介绍了FOFA搜索引擎在网络安全领域的应用，强调其用于漏洞发现、侦察和安全研究的能力，并指出其在工业控制系统、中文网络覆盖等方面的优势。

FOFA是一款强大的网络空间测绘工具，可用于漏洞发现、网络侦察和安全研究。它能搜索暴露数据库、配置错误API及工业控制系统等风险资产，在工业安全和中国网络覆盖方面优于Shodan和Censys。使用时需遵守法律和道德规范。

这篇文章讲述了一个人在学习Linux过程中遇到的各种困难与挑战。从简单的命令无法执行到复杂的依赖问题，每一次失败都成为探索系统奥秘的动力。通过查阅文档、追踪文件路径以及与包管理器互动，作者逐渐理解了系统的运作方式，并意识到真正的成长始于克服这些原始而深刻的障碍。

Rayofhope分享PortSwigger实验室第23天内容，详细解析每一步原因。通过搜索功能字段测试XSS漏洞，展示如何利用用户输入直接插入页面的特性进行攻击。

Rayofhope分享PortSwigger实验室经验，讲解如何利用未转义的搜索字段注入脚本。

文章介绍了一个基于DOM的XSS漏洞实验室，利用jQuery的`$()`函数和`location.hash`属性触发漏洞。攻击者通过构造payload，在受害者浏览器中调用`print()`函数。

文章介绍了一个基于DOM的跨站脚本（XSS）漏洞实验室。该漏洞利用jQuery的$()函数和location.hash属性实现自动滚动功能。通过构造特定payload并利用iframe和hashchange事件触发漏洞，最终在受害者浏览器中执行print()函数。

Rayofhope分享了关于PortSwigger实验室中SQL注入漏洞的知识，重点介绍了基于POST和GET方法的攻击类型，并提到识别单引号、双引号、括号和空格等关键字符的重要性。

这篇文章介绍了如何通过Union-based SQL注入攻击针对PostgreSQL数据库进行渗透测试。作者详细讲解了如何利用`information_schema.tables`和`information_schema.columns`枚举数据库表和列，并最终通过构造UNION查询获取了用户表中的敏感数据，包括用户名和密码。

文章介绍了一个SQL注入漏洞的利用过程，通过分析跟踪cookie的响应和构造payload，成功提取了数据库中管理员用户的密码并登录。

A vulnerability classified as critical was found in Ads Pro Plugin up to 4.89 on WordPress. This vulnerability affects the function getSpace. The manipulation of the argument ID leads to sql injection. This vulnerability was named CVE-2025-4381. The attack can be initiated remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Magic Buttons for Elementor Plugin up to 1.0 on WordPress. Affected is the function magic-button of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-6686. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in One Identity OneLogin Active Directory Connector up to 6.1.4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component DirectoryToken Handler. The manipulation leads to transmission of private resources into a new sphere ('resource leak'). This vulnerability is handled as CVE-2025-52925. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Drag and Drop Multiple File Upload Pro Plugin up to 1.7.1/5.0.5 on WordPress. It has been classified as critical. Affected is the function dnd_upload_cf7_upload_chunks of the file htaccess. The manipulation leads to unrestricted upload. This vulnerability is traded as CVE-2025-5746. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in Ads Pro Plugin up to 4.89 on WordPress. It has been rated as critical. Affected by this issue is the function bsa_preview_callback. The manipulation of the argument bsa_template leads to file inclusion. This vulnerability is handled as CVE-2025-4380. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Amazon Products to WooCommerce Plugin up to 1.2.7 on WordPress. It has been classified as critical. This affects the function wcta2w_get_urls. The manipulation leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2025-5817. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in QUALITIA Active mail up to 6.60.060085. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-52462. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability has been found in QUALITIA Active mail up to 6.60.060085 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. This vulnerability is known as CVE-2025-52463. The attack can be launched remotely. There is no exploit available.