Web Security Insights By Maloy Roy Orko

Hi All,  I am Maloy Roy Orko CVE Number : CVE-2025-3537 Recently in one of my pentest research, I found a Employee Management System application By tutorials-website which is an open source Employee Management System Software to manage users of a company or organization. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that the /admin/update-user.php file is vulnerable to IDOR ! It can lead into: - Unauthorized Data Access - Data Manipulation - Account Takeover - Privilege Escalation - Denial of Service (DoS) - Reputation Damage - Regulatory Consequences The Main Thing Is,If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too. Thats why, I am trying to inform everyone about this.

Hi All,  I am Maloy Roy Orko CVE Number : CVE-2025-3536 R ecently in one of my pentest research, I found a Employee Management System application By tutorials-website which is an open source  Employee Management System Software  to manage users of a company or organization. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that the delete-user.php file is vulnerable to IDOR ! It can lead into: - Unauthorized Data Access - Data Manipulation - Account Takeover - Privilege Escalation - Denial of Service (DoS) - Reputation Damage - Regulatory Consequences The Main Thing Is,If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this.

Hi All,  I am Maloy Roy Orko CVE Number: CVE-2025-3489 Recently in one of my pentest research, I found a Simple-User-Management-System-with-PHP-MySQL application By Nababur which is an open source Simple-User-Management-System to manage users of a company or organization. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of Input Validation in the Name,Username fields in register.php file. It can lead into: Session Hijacking Data Theft   Defacement   Malware Distribution Phishing Attacks   Denial of Service   Spread of Malicious Content The Main Thing Is,If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this. Title of the Vulnerability:  Simple-User-Management-System V 1.0 | Name, Username - register.ph...

  🔍 How to Get and Trace the IP Address of the Hacker Who Hacked Your Facebook Account 🔍 Have you fallen victim to a Facebook hack? Don't panic! In this comprehensive guide, we’ll walk you through the steps to identify and trace the IP address of the hacker who compromised your account. 🎉In this video, you will learn: The signs that your Facebook account has been hacked How to secure your account and prevent future hacks Tools and methods to trace the hacker's IP address Important steps to report the incident to Facebook and law enforcement Tips for enhancing your online security and privacy 📌 Resources Mentioned in the Video: 🚀IP OSINT Toolkit: http://ip-osint.ct.ws/ https://github.com/Maloyroyorko/IP-OSINT-Toolkit/ Whether you're a tech novice or an experienced user, our easy-to-follow instructions will empower you to take control of your online safety. 👉 Don’t forget to like, subscribe, and hit the notification bell for more tips on cybersecurity and online safet...

Hackers commonly use several basic attacks to hack Facebook accounts , including phishing, where they trick users into revealing their login credentials through fake websites or emails. Other methods include brute force attacks to guess passwords, social engineering to manipulate users into providing information, and exploiting vulnerabilities in third-party applications.  Additionally, hackers may employ techniques To Hack such as: Malware Installation : By sending malicious links or attachments, hackers can install software that captures keystrokes or takes control of the user's device. Fake Login Pages : Creating counterfeit Facebook login pages that mimic the real site, hackers can deceive users into entering their credentials. Session Hijacking : This involves stealing session cookies to gain unauthorized access to a user's account without needing their password. Credential Stuffing : Using stolen credentials from other breaches, hackers attempt to access Facebook account...

  Hi All,  I am Maloy Roy Orko. CVE Number: CVE-2025-2041 Recently in one of my pentest research, I found an  Ecommerce-Website-using-PHP, Bootstrap4, Html5, Css3  By  SHAHID AFRIDI ZIHAD  which is an open source E-commerce application using native PHP. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of SQL Injection protection. It can lead into mass user data in risk and database leaks can be happened by hackers too and admin panel credentials were in risk too. The Main Thing Is :  if any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this. Title of the Vulnerability: E-commerce 1.0 | shop.php?p_cat= SQL Injection | Found By Maloy Roy Orko   Vulnerability Class: SQL Injection Product Name: E-commerce 1.0...

Hi All,  I am  Maloy Roy Orko . CVE Number: CVE-2025-2035 Recently in one of my pentest research, I found an Ecommerce-Website-using-PHP, Bootstrap4, Html5, Css3 By SHAHID AFRIDI ZIHAD which is an open source E-commerce application using native PHP. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of File Extension or Upload protection In signup.php file. It  can lead into : Malware Distribution Remote Code Execution (RCE) Data Breach Denial of Service (DoS) Web Shell Installation Bypassing Security Controls Reputation Damage The  Main Thing  Is, If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this . Title  of the Vulnerability:  E-commerce V 1.0 | customer image - /customer_register.php | Remote Code Executio...

Hi All,  I am Maloy Roy Orko. CVE Number: CVE-2025-2036 Recently in one of my pentest research, I found an Ecommerce-Website-using-PHP, Bootstrap4, Html5, Css3 By SHAHID AFRIDI ZIHAD  which is an open source E-commerce application using native PHP. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of SQL Injection protection. It can lead into mass user data in risk and database leaks can be happened by hackers too and admin panel credentials were in risk too. The Main Thing Is :  if any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this. Title of the Vulnerability: E-commerce 1.0 | details.php?pro_id= SQL Injection | Found By Maloy Roy Orko   Vulnerability Class: SQL Injection Product Name: E-comm...