Aggregator

A vulnerability was found in AI Engine Plugin up to 2.8.4 on WordPress. It has been rated as problematic. Affected by this issue is the function mwai_chatbot of the component Shortcode Handler. The manipulation of the argument ID leads to cross site scripting. This vulnerability is handled as CVE-2025-5570. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_deductions. The manipulation of the argument ID leads to sql injection. This vulnerability is known as CVE-2025-7220. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_allowances. The manipulation of the argument ID leads to sql injection. This vulnerability is traded as CVE-2025-7219. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_position. The manipulation of the argument ID leads to sql injection. The identification of this vulnerability is CVE-2025-7218. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=save_position. The manipulation of the argument ID leads to sql injection. This vulnerability was named CVE-2025-7217. The attack can be initiated remotely. Furthermore, there is an exploit available.

Всё выглядело как очередной успех. Пока кто-то не заметил странное совпадение.

Submit #608264 / VDB-315169

Submit #608263 / VDB-315168

Submit #608252 / VDB-315167

Submit #608251 / VDB-315166

A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/common.php of the component PHP Object Handler. The manipulation of the argument rememberMe leads to deserialization. This vulnerability is uniquely identified as CVE-2025-7216. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

CYFIRMA has uncovered a highly sophisticated cyber-espionage campaign orchestrated by APT36, also known as Transparent Tribe, a Pakistan-based threat actor with a notorious history of targeting Indian defense and government sectors. This latest operation marks a significant shift in tactics, as APT36 adapts its arsenal to infiltrate Linux-based environments, specifically focusing on BOSS Linux, a […]

The post Inside the ZIP Trap: How APT36 Targets BOSS Linux to Exfiltrate Critical Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Citrix于6月发布三个安全漏洞（CVE编号： CVE-2025–6888, CVE–...），影响NetScaler ADC和Gateway多个版本。其中两个漏洞引发关注： CVE–... 被认为是内存泄露问题（类似CitrixBleed），而另一个可能导致控制流问题或拒绝服务。研究人员开发了针对前者exploit，并发现可泄露会话令牌和凭据。建议检查日志和审计会话以应对潜在威胁。

Submit #608209 / VDB-315165

A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of the file /rom/wpa_supplicant.conf. The manipulation leads to cleartext storage of sensitive information. This vulnerability is handled as CVE-2025-7215. It is possible to launch the attack on the physical device. Furthermore, there is an exploit available.

A vulnerability classified as problematic was found in FNKvision FNK-GU2 up to 40.1.7. Affected by this vulnerability is an unknown functionality of the file /etc/shadow of the component MD5. The manipulation leads to risky cryptographic algorithm. This vulnerability is known as CVE-2025-7214. It is possible to launch the attack on the physical device. Furthermore, there is an exploit available.

A vulnerability classified as critical has been found in FNKvision FNK-GU2 up to 40.1.7. Affected is an unknown function of the component UART Interface. The manipulation leads to on-chip debug and test interface with improper access control. This vulnerability is traded as CVE-2025-7213. It is possible to launch the attack on the physical device. Furthermore, there is an exploit available.

Submit #608030 / VDB-315164

Submit #608027 / VDB-315163

Submit #608025 / VDB-315162