Aggregator

用 Mock 热加载隔离客户端与真实后端，进行无痕沙箱测试，快进来看！

希望师傅们不仅能在TSRC收获更多的奖励，也能有更好的体验。

Полиция в нескольких странах ликвидировала мощную сеть, заманивавшую жертв с помощью дипфейков и ложной рекламы.

A vulnerability was found in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555. It has been declared as critical. This vulnerability affects unknown code of the file /product.php of the component Product Details Page. Executing manipulation of the argument ID can lead to sql injection. This vulnerability is registered as CVE-2025-14091. It is possible to launch the attack remotely. Furthermore, an exploit is available. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

A dangerous new Android spyware variant called ClayRat has emerged as a significant threat to mobile device security worldwide. First identified in October by the zLabs team, this malware represents a concerning evolution in mobile threats with capabilities that allow attackers to gain near-complete control over infected devices. The spyware demonstrates sophisticated techniques to steal […]

The post ClayRat Android Malware Steals SMS Messages, Call Logs and Capture Victim Photos appeared first on Cyber Security News.

A vulnerability was found in AMTT Hotel Broadband Operation System 1.0. It has been classified as critical. This affects an unknown part of the file /manager/card/cardmake_down.php. Performing manipulation of the argument ID results in sql injection. This vulnerability is cataloged as CVE-2025-14090. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #696514 / VDB-334481

A vulnerability was found in Himool ERP up to 2.2 and classified as critical. Affected by this issue is the function update_account of the file /api/admin/update_account/ of the component AdminActionViewSet. Such manipulation leads to improper authorization. This vulnerability is listed as CVE-2025-14089. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #696460 / VDB-334480

A vulnerability has been found in ketr JEPaaS up to 7.2.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /je/load. This manipulation of the argument Authorization causes improper authorization. This vulnerability is tracked as CVE-2025-14088. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Submit #696049 / VDB-334479

Submit #695316 / VDB-334478

A vulnerability, which was classified as critical, was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of the argument openid results in improper access controls. This vulnerability is identified as CVE-2025-14086. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. This vulnerability is referenced as CVE-2025-14085. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #695945 / VDB-334477

Submit #695943 / VDB-334476

Жертве не поможет ни осторожность, ни отказ от подозрительных ссылок — правила цифровой гигиены больше не работают.

Submit #695941 / VDB-334367