Aggregator

文章探讨了单页应用（SPA）中隐藏在JavaScript代码中的API端点和敏感信息，通过手动检查和自动化工具（如Burp Suite的JS Miner扩展）发现潜在的安全漏洞。实际案例展示了如何通过分析JavaScript代码发现管理界面或利用自定义认证头绕过权限控制，强调了深入挖掘JavaScript代码的重要性。

PlayPraetor Android RAT has hit 11K+ devices, spreading fast via campaigns targeting Spanish and French speakers, say Cleafy researchers. Cleafy researchers have identified a new Android RAT called PlayPraetor, which has infected over 11,000 devices, mainly in Portugal, Spain, France, Morocco, Peru, and Hong Kong. The malware is spreading rapidly, with more than 2,000 new […]

PlayPraetor是一种Android远程控制木马（RAT），已感染超过11,000台设备，主要针对西班牙语和法语用户。该恶意软件利用Android无障碍服务实时控制设备，并攻击近200个银行应用和加密钱包。其背后为中文威胁行为者运营，并通过多租户C2面板管理。

Mozilla has issued an urgent security warning to Firefox add-on developers following the detection of a sophisticated phishing campaign targeting accounts on the Add-ons Mozilla Organization (AMO) platform. The alert, published by Scott DeVaney from Mozilla’s Add-ons Community team on August 1, 2025, warns developers to exercise extreme caution when receiving emails purporting to be […]

The post Mozilla Issues Warning on Phishing Campaign Targeting Add-on Developer Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Как Plague умудряется воровать пароли в обход всех журналов и логов?

A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /intranet/educar_motivo_afastamento_cad.php. The manipulation of the argument nm_motivo leads to cross site scripting. This vulnerability is handled as CVE-2025-8545. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module/RegraAvaliacao/edit. The manipulation of the argument nome leads to cross site scripting. This vulnerability is known as CVE-2025-8544. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php. The manipulation of the argument nm_raca leads to cross site scripting. This vulnerability is traded as CVE-2025-8543. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the argument fantasia/razao_social leads to cross site scripting. The identification of this vulnerability is CVE-2025-8542. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/public_uf_cad.php. The manipulation of the argument nome leads to cross site scripting. This vulnerability was named CVE-2025-8541. The attack can be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument nome leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-8540. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this issue is some unknown functionality of the file /intranet/public_distrito_cad.php. The manipulation of the argument nome leads to cross site scripting. This vulnerability is handled as CVE-2025-8539. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /usuarios/tipos/novo. The manipulation of the argument name/description leads to cross site scripting. This vulnerability is known as CVE-2025-8538. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as problematic, was found in CODESYS Control RTE, Control RTE SL, Control Win, HMI, Runtime Toolkit, Control for BeagleBone SL, Control for emPC-A, iMX6 SL, Control for IOT2000 SL, Control for Linux ARM SL, Control for Linux SL, Control for PFC100 SL, Control for PFC200 SL, Control for PLCnext SL, Control for Raspberry Pi SL, Control for WAGO Touch Panels 600 SL and Virtual Control SL. This affects an unknown part of the component PKI Folder. The manipulation leads to incorrect permission assignment. This vulnerability is uniquely identified as CVE-2025-41659. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in CODESYS Control RTE, Control RTE SL, Control Win, HMI, Control for BeagleBone SL, Control for emPC-A, iMX6 SL, Control for IOT2000 SL, Control for Linux ARM SL, Control for Linux SL, Control for PFC100 SL, Control for PFC200 SL, Control for PLCnext SL, Control for Raspberry Pi SL, Control for WAGO Touch Panels 600 SL and Virtual Control SL and classified as problematic. This vulnerability affects unknown code of the component Communication Request Handler. The manipulation leads to null pointer dereference. This vulnerability was named CVE-2025-41691. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Grafana Infinity Datasource Plugin up to 3.4.0 and classified as critical. This issue affects some unknown processing of the component URL Restriction Handler. The manipulation leads to server-side request forgery. The identification of this vulnerability is CVE-2025-8341. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

Submit #620481 / VDB-318674

Submit #620480 / VDB-318673

Submit #620476 / VDB-318672

Submit #620466 / VDB-318671