Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo a1post-bg-shipping-for-woocommerce allows Privilege Escalation.This issue affects A1POST.BG Shipping for Woo: from n/a through <= 1.5. CVSSv3.1 8.8 (HIGH)
Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro chaty-pro allows Upload a Web Shell to a Web Server.This issue affects Chaty Pro: from n/a through <= 3.3.3. CVSSv3.1 10.0 (CRITICAL)
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.94.0. CVSSv3.1 9.8 (CRITICAL)
The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of untrusted input from the 'paramsv2' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an add CVSSv3.1 9.8 (CRITICAL)
The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the update_profile function. This makes it possible for unauthenticated attackers to modify victim's email via a forged request, which might lead to account takeover, granted they can trick a user into performing an action such as clicking on a link. CVSSv3.1 8.1 (HIGH)
Elastic Security Labs published a detailed technical walkthrough on how threat actors abuse AWS S3 Server-Side Encryption with Customer-Provided Keys (SSE-C) to conduct ransomware operations. The research, building on Halcyon's disclosure of in-the-wild SSE-C abuse, provides infrastructure-as-code templates, Python emulation scripts, and detection guidance for identifying this attack pattern in AWS environments. The attack requires compromised AWS credentials with S3 permissions and leverages AWS SigV4 signing to encrypt victim data with attacker-controlled keys, rendering recovery impossible without the attacker's cooperation.
Lexmark MX6500 LW75.JD.P296 and previous devices have Incorrect Access Control via the access control settings. CVSSv3.1 9.1 (CRITICAL) · EPSS 25th percentile
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Path Traversal.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.2.12. CVSSv3.1 8.6 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Oscar Alvarez Cookie Monster cookie-monster allows PHP Local File Inclusion.This issue affects Cookie Monster: from n/a through <= 1.2.2. CVSSv3.1 8.1 (HIGH)
Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified simplified allows Using Malicious Files.This issue affects Simplified: from n/a through <= 1.0.6. CVSSv3.1 10.0 (CRITICAL)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance Rate Shipping for WooCommerce distance-rate-shipping-for-woocommerce-pro allows Blind SQL Injection.This issue affects Distance Rate Shipping for WooCommerce: from n/a through <= 1.3.4. CVSSv3.1 8.5 (HIGH)
Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through < 5.4.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 27th percentile
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. CVSSv3.1 6.8 (MEDIUM) · EPSS 99th percentile
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls. This issue affects KLog Server: before 3.1.1. CVSSv3.1 5.7 (MEDIUM) · EPSS 99th percentile
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is en CVSSv3.1 9.8 (CRITICAL)
The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the reset_db_page() function. This makes it possible for unauthenticated attackers to reset several tables in the database like comments, themes, plugins, and more via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.1 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows SQL Injection.This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through <= 2.3.11. CVSSv3.1 9.3 (CRITICAL)
Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0. CVSSv3.1 8.5 (HIGH) · EPSS 27th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allows SQL Injection. This issue affects Mobuy Online Machinery Monitoring Panel: before 2.0. CVSSv3.1 10.0 (CRITICAL) · EPSS 27th percentile
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Marketing Fire Widget Options widget-options allows OS Command Injection.This issue affects Widget Options: from n/a through <= 4.1.0. CVSSv3.1 9.9 (CRITICAL)
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information. CVSSv3.1 8.3 (HIGH) · EPSS 52th percentile
Volexity disclosed coordinated campaigns by Russian threat actors (CozyLarch/APT29, UTA0304, UTA0307) exploiting Microsoft Device Code Authentication flow via spear-phishing and social engineering since mid-January 2025. Attackers impersonated US State Department, Ukrainian Ministry of Defence, and EU Parliament officials to trick targets into entering device codes, granting long-term account access to M365 tenants. The technique bypasses MFA by leveraging the legitimate 15-minute device code window and real-time communication coordination to ensure victim compliance.
Elastic Security Labs discovered FINALDRAFT, a previously unknown malware family targeting foreign ministries, deployed via PATHLOADER. The backdoor uses Microsoft Graph API and Outlook drafts for C2 communication, includes advanced post-exploitation modules (process injection, PowerShell execution, Pass-the-Hash), and exists in both Windows PE and Linux ELF variants, suggesting a sophisticated, long-running espionage campaign.
Elastic Security Labs disclosed REF7707, a sophisticated intrusion campaign targeting a South American foreign ministry with novel malware families (FINALDRAFT, GUIDLOADER, PATHLOADER). The campaign demonstrates advanced capabilities including CDB.exe abuse for shellcode execution, Microsoft Graph API for C2, and cross-platform (Windows/Linux) malware variants, but was exposed through poor operational security that revealed additional infrastructure and victims across Southeast Asia.
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access CVSSv3.1 9.1 (CRITICAL) · EPSS 100th percentile