News & Sicurezza

EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application data and credentials.

BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to extract database schema information and table contents from the application database.

Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injecting malicious code through the txtCustomerCode, txtCustomerName, and txtPhone POST parameters in SearchCustomer.php. Attackers can submit crafted SQL statements using UNION SELECT to extract sensitive database information including usernames, database names, and version details.

Apache ActiveMQ Allow Attackers to Trigger DoS Attacks With Malformed Packets Apache ActiveMQ Trigger DoS Attacks With Malformed Packets A medium-severity flaw in ActiveMQ (CVE-2025-66168, CVSS 5.4) allows authenticated attackers to trigger a Denial-of-Service (DoS) using malfo ... Read more Published Date: Mar 06, 2026 (2 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-66168

Duizenden WordPress-sites bevatten misbruikt lek dat aanvaller admin maakt Duizenden WordPress-sites bevatten een kwetsbaarheid die op het moment actief wordt misbruikt bij aanvallen en ongeauthenticeerde aanvallers administrator maakt. Zodoende kunnen aanvallers de website ... Read more Published Date: Mar 06, 2026 (2 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1492

A Satellite Receiver Trusted by Pentagon, ESA Has More Than 20 Security Flaws — and the Maker Never Responded A penetration tester found more than 20 vulnerabilities in a satellite receiver deployed by the U.S. Department of Defense (also referred to as the Department of War), the European Space Agency, and o ... Read more Published Date: Mar 06, 2026 (2 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-29128 CVE-2026-28778 CVE-2026-28775 CVE-2026-28769

CVE ID : CVE-2018-25200 Published : March 6, 2026, 1:16 p.m. | 3 hours, 35 minutes ago Description : OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requests. Attackers can submit forms to the addUser.php endpoint with parameters including userName, password, email, and role set to administrative privileges to gain unauthorized access. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2018-25198 Published : March 6, 2026, 1:16 p.m. | 3 hours, 35 minutes ago Description : eToolz 3.4.8.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying oversized input buffers. Attackers can create a payload file containing 255 bytes of data that triggers a buffer overflow condition when processed by the application. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2018-25190 Published : March 6, 2026, 1:16 p.m. | 1 hour, 35 minutes ago Description : Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username, password, name, surname, and privileges set to 1 for administrator access. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2018-25184 Published : March 6, 2026, 1:16 p.m. | 1 hour, 35 minutes ago Description : Surreal ToDo 0.6.1.2 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the content parameter. Attackers can supply directory traversal sequences through the content parameter in index.php to access sensitive system files like configuration and initialization files. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2018-25186 Published : March 6, 2026, 1:16 p.m. | 1 hour, 35 minutes ago Description : Tina4 Stack 1.0.3 contains a cross-site request forgery vulnerability that allows attackers to modify admin user credentials by submitting forged POST requests to the profile endpoint. Attackers can craft HTML forms targeting the /kim/profile endpoint with hidden fields containing malicious user data like passwords and email addresses to update administrator accounts without authentication. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2018-25177 Published : March 6, 2026, 1:15 p.m. | 1 hour, 35 minutes ago Description : Data Center Audit 2.6.2 contains a cross-site request forgery vulnerability that allows attackers to reset administrator passwords without authentication by submitting crafted POST requests. Attackers can send requests to dca_resetpw.php with parameters updateuser, pass, pass2, and submit_reset to change the admin account password and gain administrative access. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...