Web Security Insights By Maloy Roy Orko

CVE ID : CVE-2025-54477 Published : Sept. 30, 2025, 4:15 p.m. | 1 hour, 51 minutes ago Description : Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/2ATgGdw via IFTTT

CVE ID : CVE-2025-54476 Published : Sept. 30, 2025, 4:15 p.m. | 1 hour, 51 minutes ago Description : Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/bCIdEFQ via IFTTT

CVE ID : CVE-2025-41244 Published : Sept. 29, 2025, 5:15 p.m. | 51 minutes ago Description : VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/xuFQhve via IFTTT

CVE ID : CVE-2024-57412 Published : Sept. 29, 2025, 5:15 p.m. | 51 minutes ago Description : An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/uJz9ZqU via IFTTT

CVE ID : CVE-2025-11110 Published : Sept. 28, 2025, 4:15 p.m. | 1 hour, 50 minutes ago Description : A security flaw has been discovered in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/school_year.php. The manipulation of the argument school_year results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/SVRqpL1 via IFTTT

CVE ID : CVE-2025-11068 Published : Sept. 27, 2025, 4:15 p.m. | 1 hour, 50 minutes ago Description : A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/Ulvuei4 via IFTTT

CVE ID : CVE-2025-11027 Published : Sept. 26, 2025, 4:15 p.m. | 1 hour, 49 minutes ago Description : A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release." Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/07Fih9B via IFTTT

CVE ID : CVE-2025-20333 Published : Sept. 25, 2025, 4:15 p.m. | 1 hour, 49 minutes ago Description : A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device. Severity: 9.9 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/u1DHNgK via IFTTT

CVE ID : CVE-2025-10953 Published : Sept. 25, 2025, 4:15 p.m. | 1 hour, 49 minutes ago Description : A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. This vulnerability affects unknown code of the file /goform/formApMail. The manipulation of the argument senderEmail leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/ZCdpBja via IFTTT

CVE ID : CVE-2025-20149 Published : Sept. 24, 2025, 5:14 p.m. | 50 minutes ago Description : A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a buffer overflow. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/meZgMjy via IFTTT

CVE ID : CVE-2025-20313 Published : Sept. 24, 2025, 5:12 p.m. | 51 minutes ago Description : Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust. These vulnerabilities are due path traversal and improper image integrity validation. A successful exploit could allow the attacker to execute persistent code on the underlying operating system. Because this allows the attacker to bypass a major security feature of the device, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. ERP Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://if...

CVE ID : CVE-2025-57407 Published : Sept. 23, 2025, 4:15 p.m. | 1 hour, 48 minutes ago Description : A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/8yxlw20 via IFTTT

CVE ID : CVE-2025-9038 Published : Sept. 22, 2025, 3:15 p.m. | 2 hours, 47 minutes ago Description : Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/icO3IR5 via IFTTT

Lookdoor Framework tool is developed in the Bash Script and available on the GitHub platform for free ‼️‼️ PC ©GeekforGeeks It can be used in web hacking, information gathering,privilege escalation,exploitation and encryption-decryptions. Interestingly,there are Pentesting & Security Assessment Finding Reports Templates. GitHub Repository: https://github.com/SofianeHamlaoui/Lockdoor-Framework Installation: git clone https://github.com/SofianeHamlaoui/Lockdoor-Framework   cd Lockdoor-Framework   sudo chmod +x ./install.sh   sudo ./install.sh Review By Maloy Roy Orko 

CVE ID : CVE-2025-10767 Published : Sept. 22, 2025, 1:08 a.m. | 54 minutes ago Description : A vulnerability was detected in CosmodiumCS OnlyRAT up to 3.2. The affected element is the function connect/remote_upload/remote_download of the file main.py of the component Configuration File Handler. The manipulation of the argument configuration["PASSWORD"] results in os command injection. The attack requires a local approach. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/qXU02Od via IFTTT

CVE ID : CVE-2025-10771 Published : Sept. 22, 2025, 1:08 a.m. | 54 minutes ago Description : A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/nPSzZN1 via IFTTT

CVE ID : CVE-2025-10772 Published : Sept. 22, 2025, 1:08 a.m. | 54 minutes ago Description : A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads to missing authentication. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/CPAWuOY via IFTTT

CVE ID : CVE-2025-53692 Published : Sept. 21, 2025, 9:10 p.m. | 52 minutes ago Description : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/oYO5mEd via IFTTT

CVE ID : CVE-2025-10757 Published : Sept. 21, 2025, 1:08 a.m. | 51 minutes ago Description : A weakness has been identified in UTT 1200GW up to 3.0.0-170831. The affected element is an unknown function of the file /goform/formConfigDnsFilterGlobal. This manipulation of the argument GroupName causes buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/BUZ5JH7 via IFTTT

CVE ID : CVE-2025-10756 Published : Sept. 21, 2025, 1:08 a.m. | 51 minutes ago Description : A security flaw has been discovered in UTT HiPER 840G up to 3.1.1-190328. Impacted is an unknown function of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/Ua7gjM2 via IFTTT

CVE ID : CVE-2025-40925 Published : Sept. 20, 2025, 3:09 p.m. | 2 hours, 50 minutes ago Description : Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/K51phog via IFTTT

CVE ID : CVE-2025-10741 Published : Sept. 20, 2025, 3:09 p.m. | 2 hours, 50 minutes ago Description : A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Handler. The manipulation of the argument userAvatar leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/zigEWOI via IFTTT

CVE ID : CVE-2025-55910 Published : Sept. 19, 2025, 4:15 p.m. | 1 hour, 39 minutes ago Description : CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/ZFp9eJx via IFTTT

CVE ID : CVE-2023-53432 Published : Sept. 18, 2025, 4:15 p.m. | 1 hour, 36 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: firewire: net: fix use after free in fwnet_finish_incoming_packet() The netif_rx() function frees the skb so we can't dereference it to save the skb->len. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/POkmvIW via IFTTT

CVE ID : CVE-2025-10599 Published : Sept. 17, 2025, 4:15 p.m. | 1 hour, 33 minutes ago Description : A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the file login.php. Performing manipulation of the argument user_email results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/vDpc8yr via IFTTT

CVE ID : CVE-2025-10598 Published : Sept. 17, 2025, 4:15 p.m. | 1 hour, 33 minutes ago Description : A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This issue affects some unknown processing of the file /admin/search_product.php. Such manipulation of the argument group_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/FcdzNw6 via IFTTT

CVE ID : CVE-2023-53321 Published : Sept. 16, 2025, 5:15 p.m. | 32 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: drop short frames While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address header to avoid accessing invalid memory if shorter frames are passed in. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/Fa7uwzR via IFTTT

CVE ID : CVE-2023-53320 Published : Sept. 16, 2025, 5:15 p.m. | 32 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() The function mpi3mr_get_all_tgt_info() has four issues: 1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64). 2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices. 3) It copies num_device by calling memcpy(). Substitution is enough. 4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds". Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the cor...

CVE ID : CVE-2025-52344 Published : Sept. 15, 2025, 6:15 p.m. | 1 hour, 29 minutes ago Description : Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the Group name and Project Description input fields. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/sAv0YIE via IFTTT

CVE ID : CVE-2025-43791 Published : Sept. 15, 2025, 6:15 p.m. | 1 hour, 29 minutes ago Description : Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a "Rich Text" type field to (1) a web content structure, (2) a Documents and Media Document Type , or (3) custom assets that uses the Data Engine's module Rich Text field. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/myvrS8R via IFTTT

CVE ID : CVE-2025-10403 Published : Sept. 14, 2025, 6:15 p.m. | 1 hour, 27 minutes ago Description : A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/view-enquiry.php. The manipulation of the argument viewid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Severity: 7.5 | HIGH

CVE ID : CVE-2025-10401 Published : Sept. 14, 2025, 4:15 p.m. | 1 hour, 26 minutes ago Description : A vulnerability was detected in D-Link DIR-823x up to 250416. The affected element is an unknown function of the file /goform/diag_ping. Performing manipulation of the argument target_addr results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. Severity: 6.5 | MEDIUM

CVE ID : CVE-2025-10371 Published : Sept. 13, 2025, 6:15 p.m. | 1 hour, 23 minutes ago Description : A security flaw has been discovered in eCharge Hardy Barth Salia PLCC 2.2.0. This issue affects some unknown processing of the file /api.php. The manipulation of the argument setrfidlist results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.5 | HIGH

CVE ID : CVE-2025-39793 Published : Sept. 12, 2025, 4:15 p.m. | 1 hour, 20 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/F0f39ik via IFTTT

CVE ID : CVE-2025-10320 Published : Sept. 12, 2025, 4:15 p.m. | 1 hour, 20 minutes ago Description : A vulnerability was detected in iteachyou Dreamer CMS up to 4.1.3.2. This issue affects some unknown processing of the file /admin/user/updatePwd. Performing manipulation results in weak password requirements. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 3.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/p2E3v5t via IFTTT

CVE ID : CVE-2025-39767 Published : Sept. 11, 2025, 5:15 p.m. | 17 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: LoongArch: Optimize module load time by optimizing PLT/GOT counting When enabling CONFIG_KASAN, CONFIG_PREEMPT_VOLUNTARY_BUILD and CONFIG_PREEMPT_VOLUNTARY at the same time, there will be soft deadlock, the relevant logs are as follows: rcu: INFO: rcu_sched self-detected stall on CPU ... Call Trace: [<900000000024f9e4>] show_stack+0x5c/0x180 [<90000000002482f4>] dump_stack_lvl+0x94/0xbc [<9000000000224544>] rcu_dump_cpu_stacks+0x1fc/0x280 [<900000000037ac80>] rcu_sched_clock_irq+0x720/0xf88 [<9000000000396c34>] update_process_times+0xb4/0x150 [<90000000003b2474>] tick_nohz_handler+0xf4/0x250 [<9000000000397e28>] __hrtimer_run_queues+0x1d0/0x428 [<9000000000399b2c>] hrtimer_interrupt+0x214/0x538 [<9000000000253634>] constant_timer_interrupt+0x64/0x80 [<90000000003...

CVE ID : CVE-2025-20340 Published : Sept. 10, 2025, 4:15 p.m. | 1 hour, 15 minutes ago Description : A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service (DoS) condition on an affected device.  This vulnerability is due to how Cisco IOS XR Software processes a high, sustained rate of ARP traffic hitting the management interface. Under certain conditions, an attacker could exploit this vulnerability by sending an excessive amount of traffic to the management interface of an affected device, overwhelming its ARP processing capabilities. A successful exploit could result in degraded device performance, loss of management connectivity, and complete unresponsiveness of the system, leading to a DoS condition. Severity: 7.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and m...

CVE ID : CVE-2025-20159 Published : Sept. 10, 2025, 4:15 p.m. | 1 hour, 15 minutes ago Description : A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features. This vulnerability exists because management interface ACLs have not been supported on Cisco IOS XR Software Packet I/O infrastructure platforms for Linux-handled features such as SSH, NetConf, or gRPC. An attacker could exploit this vulnerability by attempting to send traffic to an affected device. A successful exploit could allow the attacker to bypass an ingress ACL that is applied on the management interface of the affected device. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/I91ovjB via IFTTT

CVE ID : CVE-2025-59005 Published : Sept. 9, 2025, 5:16 p.m. | 1 hour, 41 minutes ago Description : Missing Authorization vulnerability in frenify Categorify allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Categorify: from n/a through 1.0.7.5. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/UImQnjB via IFTTT

CVE ID : CVE-2025-51586 Published : Sept. 8, 2025, 5:15 p.m. | 1 hour, 39 minutes ago Description : An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature. Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/aQMuEFd via IFTTT

CVE ID : CVE-2025-10098 Published : Sept. 8, 2025, 5:15 p.m. | 1 hour, 39 minutes ago Description : A security flaw has been discovered in PHPGurukul User Management System 1.0. Affected is an unknown function of the file /admin/edit-user-profile.php. The manipulation of the argument uid results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/kdngKQA via IFTTT

Smuggler is a free software tool to detect and exploit -HTTP Smuggling- vulnerabilities. HTTP request smuggling is a technique for interfering with the way a web site processes sequences of HTTP requests that are received from one or more users. Documentation:   https://github.com/defparam/smuggler Commands: Installation: git clone https://github.com/defparam/smuggler.git   cd smuggler   python3 smuggler.py -h Example Usage: Single Host: python3 smuggler.py -u <URL>   List of hosts: cat list_of_hosts.txt | python3 smuggler.py Stay with us: Web Security Insights Wanna know about more cyber security tools? Click me Tool Was Reviewed By Maloy Roy Orko

IP OSINT Toolkit is an open-source project made by Maloy Roy Orko to help in our cyber security field featuring ip address osint with tracing,mass ip location tracing,forward & reverse geocoding and other features to osint an ip address. Documentation: https://github.com/Maloyroyorko/IP-OSINT-Toolkit Demo : http://ip-osint.ct.ws/ Video Tutorial : https://youtu.be/rH-lb-2zHQw?si=vEUNEEb9dopTfUnW

Metasploit-Installer-1.0 Is A Bash Script which is used for installing Metasploit in termux type command lines in short time and with less efforts. Documentation: https://github.com/Maloyroyorko/Metasploit-Installer-1.0/ Commands: git clone https://github.com/Maloyroyorko/Metasploit-Installer-1.0/ cd  Metasploit-Installer-1.0 chmod 777 install.sh && ./install.sh Tool was reviewed by Maloy Roy Orko

CVE ID : CVE-2025-10071 Published : Sept. 7, 2025, 11:15 p.m. | 1 hour, 24 minutes ago Description : A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/wDsp8zo via IFTTT

CVE ID : CVE-2025-10070 Published : Sept. 7, 2025, 10:15 p.m. | 24 minutes ago Description : A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/qhxGg5T via IFTTT

CVE ID : CVE-2023-31325 Published : Sept. 6, 2025, 5:15 p.m. | 1 hour, 20 minutes ago Description : Improper isolation of shared resources on System-on-a-chip (SOC) could a privileged attacker to tamper with the contents of the PSP reserved DRAM region potentially resulting in loss of confidentiality and integrity. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/grhNGKu via IFTTT

CVE ID : CVE-2023-31322 Published : Sept. 6, 2025, 5:15 p.m. | 1 hour, 20 minutes ago Description : Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted application (RAS TA) potentially leading to a read or write to shared memory resulting in loss of confidentiality, integrity, or availability. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/c9iHQTW via IFTTT

CVE ID : CVE-2024-0028 Published : Sept. 5, 2025, 5:15 p.m. | 27 minutes ago Description : In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/PDurVQy via IFTTT

CVE ID : CVE-2025-10013 Published : Sept. 5, 2025, 4:15 p.m. | 1 hour, 27 minutes ago Description : A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/hCut0DI via IFTTT

CVE ID : CVE-2025-26429 Published : Sept. 4, 2025, 5:11 p.m. | 24 minutes ago Description : In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Severity: 0.0 | NA

CVE ID : CVE-2025-26428 Published : Sept. 4, 2025, 5:11 p.m. | 24 minutes ago Description : In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Severity: 0.0 | NA

Sublist3r is a tool designed in python and uses OSINT in order to enumerate subdomains of websites. It helps pen-testers in collecting and gathering subdomains for a domain which is their target. In order to fetch the accurate results, sublilster uses many search engines like Google, Yahoo, etc. and even tools like Netcraft, Virustotal, etc. Github Repository: https://github.com/aboul3la/Sublis t3r Tool Installation Proccess: To install sublist3r,you can clone the github repository and use it. To do it, you can follow the following command: git clone https://github.com/aboul3la/Sublist3r Once the process is done,move to the sublist3r directory. cd Sublist3r Now we need to check for dependencies as sublist3r depends on requests, dnspython, and argparse python modules. These dependencies can be installed using requirements.txt file:  pip install -r requirements.txt You can even manually install all the required modules. Requests module:  sudo pip install requests  dnspyth...

CVE ID : CVE-2025-9919 Published : Sept. 3, 2025, 4:15 p.m. | 2 hours, 34 minutes ago Description : A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Severity: 7.5 | HIGH

CVE ID : CVE-2025-55373 Published : Sept. 2, 2025, 5:15 p.m. | 1 hour, 33 minutes ago Description : Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights. Severity: 0.0 | NA

CVE ID : CVE-2025-9788 Published : Sept. 1, 2025, 6:15 p.m. | 2 hours, 30 minutes ago Description : A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_class.php. Executing manipulation of the argument id_no can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Severity: 7.5 | HIGH

CVE ID : CVE-2025-3586 Published : Sept. 1, 2025, 6:15 p.m. | 2 hours, 30 minutes ago Description : In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses. Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances. Severity: 7.5 | HIGH Visit the link for more details, such...

CVE ID : CVE-2025-9375 Published : Sept. 1, 2025, 5:15 p.m. | 1 hour, 30 minutes ago Description : XML Injection vulnerability in xmltodict allows Input Data Manipulation.This issue affects xmltodict: 0.14.2. Severity: 6.9 | MEDIUM