Aggregator

CVE-2025-8223 | jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999 AdminTypeCustController.java cross-site request forgery (EUVD-2025-22811)

VulDB Recent Entries
1 week 5 days ago
A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. This affects an unknown part of the file AdminTypeCustController.java. The manipulation leads to cross-site request forgery. This vulnerability is uniquely identified as CVE-2025-8223. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
vuldb.com

CVE-2025-8222 | jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999 GoodsController.java cross site scripting (EUVD-2025-22812)

VulDB Recent Entries
1 week 5 days ago
A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this issue is some unknown functionality of the file GoodsController.java. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2025-8222. The attack may be launched remotely. Furthermore, there is an exploit available. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Multiple endpoints are affected.
vuldb.com

CVE-2025-8221 | jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999 GoodsCustController.java goodsSearch keyword cross site scripting (EUVD-2025-22810)

VulDB Recent Entries
1 week 5 days ago
A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController.java. The manipulation of the argument keyword leads to cross site scripting. This vulnerability is known as CVE-2025-8221. The attack can be launched remotely. Furthermore, there is an exploit available. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
vuldb.com

Arizona woman sentenced for aiding North Korea in U.S. IT job fraud scheme

Security Affairs
1 week 5 days ago
Arizona woman gets 8 years for helping North Korea-linked threat actors to infiltrate 309 U.S. firms with fake IT jobs. Christina Marie Chapman (50) from Arizona, was sentenced to 102 months in prison for aiding North Korean IT workers in infiltrating 309 U.S. companies. She pleaded guilty to charges including aggravated identity theft, conspiracy to […]
Pierluigi Paganini

cervantes: open-source collaborative platform for pentesters or red teams

Penetration Testing Tools - Metepreter.org
1 week 5 days ago

Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients, vulnerabilities, and reports in a single, centralized location....

The post cervantes: open-source collaborative platform for pentesters or red teams appeared first on Penetration Testing Tools.

ddos

Arizona Woman Sentenced for Aiding North Korean IT Workers in Cyber Operations

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
1 week 5 days ago

Christina Marie Chapman, a 50-year-old Arizona woman, has been sentenced to 102 months in prison for her role in an elaborate fraud scheme that helped North Korean IT workers pose as U.S. citizens to obtain remote positions at over 300 American companies. The scheme generated more than $17 million in illicit revenue for both Chapman […]

The post Arizona Woman Sentenced for Aiding North Korean IT Workers in Cyber Operations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Kaaviya

CVE-2025-8220 | Engeman Web up to 12.0.0.1 Password Recovery Page /Login/RecoveryPass LanguageCombobox sql injection (EUVD-2025-22808)

VulDB Recent Entries
1 week 5 days ago
A vulnerability classified as critical has been found in Engeman Web up to 12.0.0.1. Affected is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox leads to sql injection. This vulnerability is traded as CVE-2025-8220. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2025-8219 | Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7 HTTP POST Request tabdetail_moduleSave_dxkp.php getvaluestring sql injection (EUVD-2025-22807)

VulDB Recent Entries
1 week 5 days ago
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. It has been rated as critical. This issue affects some unknown processing of the file /crm/crmapi/erp/tabdetail_moduleSave_dxkp.php of the component HTTP POST Request Handler. The manipulation of the argument getvaluestring leads to sql injection. The identification of this vulnerability is CVE-2025-8219. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+. We strongly advise all customers to upgrade to the current version (v8.6.5.2), which includes this fix and additional security enhancements."
vuldb.com

Managed ad