Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Remote Code Inclusion.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.3. CVSSv3.1 9.9 (CRITICAL)
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.0.31. CVSSv3.1 8.8 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Blind SQL Injection.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.3. CVSSv3.1 8.5 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.20. CVSSv3.1 9.3 (CRITICAL)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in octagonwebstudio Premium Addons for KingComposer premium-addons-for-kingcomposer allows PHP Local File Inclusion.This issue affects Premium Addons for KingComposer: from n/a through <= 1.1.1. CVSSv3.1 8.1 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.3. CVSSv3.1 8.5 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows PHP Local File Inclusion.This issue affects Geo Mashup: from n/a through <= 1.13.16. CVSSv3.1 9.8 (CRITICAL)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows SQL Injection.This issue affects Pinterest Automatic Pin: from n/a through < 4.19.0. CVSSv3.1 8.5 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rico Macchi WP Links Page wp-links-page allows SQL Injection.This issue affects WP Links Page: from n/a through <= 4.9.6. CVSSv3.1 8.5 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeAtelier IDonatePro idonate-pro allows PHP Local File Inclusion.This issue affects IDonatePro: from n/a through <= 2.1.9. CVSSv3.1 8.1 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes wp-pipes allows PHP Local File Inclusion.This issue affects WP Pipes: from n/a through <= 1.4.3. CVSSv3.1 8.1 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4. CVSSv3.1 10.0 (CRITICAL)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 VidMov vidmov allows PHP Local File Inclusion.This issue affects VidMov: from n/a through <= 1.9.4. CVSSv3.1 8.1 (HIGH)
Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through <= 2.9.0. CVSSv3.1 9.9 (CRITICAL)
Trend Micro disclosed detailed analysis of Crypto24 ransomware group conducting multi-stage attacks across Asia, Europe, and USA targeting financial services, manufacturing, entertainment, and technology sectors. The group combines legitimate tools (PSExec, AnyDesk, RDP patching) with custom malware including a RealBlindingEDR variant, keyloggers, and VMProtect-hardened ransomware payloads, using advanced evasion including UAC bypass via COM interface exploitation and EDR disablement via Group Policy abuse. Attackers maintain persistence through scheduled tasks, privileged account creation, and Google Drive exfiltration of keylogged credentials.
Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication. CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile
In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. CVSSv3.1 9.8 (CRITICAL) · EPSS 33th percentile
In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm. CVSSv3.1 9.8 (CRITICAL) · EPSS 33th percentile
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. CVSSv3.1 9.8 (CRITICAL) · EPSS 68th percentile
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions < V20 Update 4), SIMATIC WinCC V17 (All versions < V17 Update 9), SIMATIC WinCC V18 (All versions), SIMA CVSSv3.1 8.2 (HIGH) · EPSS 46th percentile
The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVSSv3.1 8.1 (HIGH)
Trend Micro identified Charon, a new ransomware family deployed in targeted attacks against Middle East public sector and aviation organizations, using DLL sideloading (Edge.exe → msedge.dll) and process injection techniques similar to Earth Baxia APT campaigns. The malware employs multi-stage encrypted payloads, Curve25519+ChaCha20 hybrid encryption, anti-EDR capabilities via the Dark-Kill driver, and network propagation to encrypt both local and network shares with customized ransom notes.
AMSI-Bypass-HWBP is a Rust-based debugger tool that bypasses Windows Defender's Antimalware Scan Interface (AMSI) by attaching to PowerShell processes and setting hardware breakpoints on AmsiScanBuffer(), then reducing the scanned buffer length to 1 byte to evade detection. The technique exploits the AMSI scanning mechanism by manipulating the R8 register (length parameter) to force the function to scan only a single byte, resulting in AMSI_RESULT_CLEAN responses.