Aggregator

A vulnerability classified as critical has been found in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec.php. This manipulation of the argument image causes unrestricted upload. This vulnerability is registered as CVE-2025-11351. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability classified as critical was found in code-projects Online Hotel Reservation System 1.0. This affects an unknown function of the file /admin/addexec.php. Such manipulation of the argument image leads to unrestricted upload. This vulnerability is documented as CVE-2025-11352. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability labeled as problematic has been found in pdfmake up to 0.3.0-beta.16. This vulnerability affects unknown code. The manipulation results in allocation of resources. This vulnerability is known as CVE-2025-11362. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability, which was classified as critical, has been found in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Performing manipulation of the argument image results in unrestricted upload. This vulnerability is reported as CVE-2025-11353. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability identified as critical has been detected in Admin and Customer Messages After Order for WooCommerce Plugin up to 13 on WordPress. This affects an unknown part. The manipulation leads to path traversal. This vulnerability is traded as CVE-2025-10162. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

一项全球调查显示，人工智能技术成为未来一年企业网络安全投资重点（60%），主要用于威胁检测、行为分析等领域。53%的企业优先利用AI弥补技能缺口，38%依赖外部服务提供商提供技术支持。专家指出AI代理需严格权限管理以避免数据泄露，并警告其可能成为攻击目标。尽管多数企业平衡主动防御与被动响应投入，但仅6%对防御能力充满信心。量子安全技术仍处试点阶段。

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of active exploitation of a critical privilege escalation vulnerability in Microsoft Windows. Known as CVE-2021-43226, this flaw resides in the Common Log File System (CLFS) driver. Attackers who gain local access can bypass security controls and elevate their privileges, potentially leading to full system compromise. Background […]

The post CISA Issues Alert on Active Exploitation of Microsoft Windows Privilege Escalation Flaw appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Группировка Medusa нашла «золотую жилу» в популярном корпоративном софте.

CISA has issued an urgent security advisory, adding Microsoft Windows privilege escalation vulnerability CVE-2021-43226 to its Known Exploited Vulnerabilities (KEV) catalog on October 6, 2025.  The vulnerability affects the Microsoft Windows Common Log File System (CLFS) Driver and poses significant security risks to enterprise environments. The CVE-2021-43226 vulnerability resides within Microsoft’s Common Log File System […]

The post CISA Warns of Windows Privilege Escalation Vulnerability Exploited in Attacks appeared first on Cyber Security News.

首席安全官（CSO）的角色已从技术防御转向战略业务领导，直接影响企业增长和客户信任。如今的CSO需将安全与收入增长挂钩，通过有效沟通和跨部门协作推动组织发展。

A vulnerability described as critical has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/voters_add.php. Executing manipulation of the argument firstname can lead to sql injection. This vulnerability is handled as CVE-2025-11410. The attack can be executed remotely. Additionally, an exploit exists. Other parameters might be affected as well.

A vulnerability marked as critical has been reported in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /index.php. Performing manipulation of the argument voter results in sql injection. This vulnerability is known as CVE-2025-11409. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability labeled as critical has been found in D-Link DI-7001 MINI 24.04.18B1. The affected element is an unknown function of the file /dbsrv.asp. Such manipulation of the argument str leads to buffer overflow. This vulnerability is traded as CVE-2025-11408. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability identified as critical has been detected in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. This vulnerability appears as CVE-2025-11407. The attack may be initiated remotely. In addition, an exploit is available.

Submit #665586 / VDB-327347

Submit #665542 / VDB-327346

Submit #665474 / VDB-327345

Submit #665471 / VDB-327344

A vulnerability categorized as problematic has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java. The manipulation results in information disclosure. This vulnerability is reported as CVE-2025-11406. The attack can be launched remotely. Moreover, an exploit is present. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

A vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0. It has been rated as critical. This vulnerability affects unknown code of the file /del_tax.php. The manipulation of the argument ID leads to sql injection. This vulnerability is documented as CVE-2025-11405. The attack can be initiated remotely. Additionally, an exploit exists.