A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 1fdd96104180cc0fb5d3cb086b05ab6458911bb9. It is recommended to apply a patch to fix this issue.

CVE-2025-7207 is a heap-based buffer overflow vulnerability identified in the mruby project, specifically affecting versions up to 3.4.0-rc2. The flaw resides in the function scope_new within the mrbgems/mruby-compiler/core/codegen.c source file, related to the nregs Handler component. This vulnerability arises from improper handling of memory allocation or bounds checking, allowing an attacker to overflow a heap buffer. Exploitation requires local access with at least low privileges (PR:L), and no user interaction is necessary. The vulnerability does not affect confidentiality, integrity, or availability directly but can lead to potential memory corruption issues that might be leveraged for arbitrary code execution or denial of service under certain conditions. The CVSS 4.0 vector indicates low attack complexity and no need for user interaction, but the attack surface is limited to local access, reducing the overall risk. The patch identified by commit 1fdd96104180cc0fb5d3cb086b05ab6458911bb9 addresses this issue. While no known exploits are currently in the wild, the public disclosure of the vulnerability increases the risk of exploitation attempts. Mruby is a lightweight Ruby implementation often embedded in applications or used in IoT devices, development tools, or embedded systems, which means the vulnerability could affect a variety of software relying on mruby for scripting capabilities.

CVE Database V5

Detailed information about CVE-2025-7207: Heap-based Buffer Overflow in mruby affecting null mruby. Get real-time updates, technical details, and mitigation str

CVE-2025-7207: Heap-based Buffer Overflow in mruby - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7207: Heap-based Buffer Overflow in mruby

The provided information pertains to a set of Indicators of Compromise (IOCs) published on July 8, 2025, by the ThreatFox MISP Feed, categorized under malware with a focus on OSINT (Open Source Intelligence), network activity, and payload delivery. The data appears to be a collection of threat intelligence indicators rather than a description of a specific vulnerability or exploit. No affected software versions or products are listed, and there are no known exploits in the wild associated with these IOCs. The threat level is indicated as medium with a threatLevel score of 2 and distribution score of 3, suggesting moderate dissemination potential. The absence of patch availability and exploit details implies that these IOCs are primarily for detection and monitoring purposes rather than immediate active threats. The tags and categories emphasize the role of these IOCs in identifying network-based malicious activities and payload delivery mechanisms, which are typical in malware campaigns. However, the lack of technical specifics, such as malware family, attack vectors, or targeted systems, limits the ability to provide a detailed technical breakdown of the threat. Overall, this entry serves as an intelligence update to assist security teams in recognizing potential malicious network behaviors and payloads through OSINT methods.

ThreatFox MISP Feed

Lumma Stealer botnet C2 domain (confidence level: 100%)

Cobalt Strike botnet C2 server (confidence level: 100%)

Remcos botnet C2 server (confidence level: 100%)

SectopRAT botnet C2 server (confidence level: 100%)

Unknown malware botnet C2 server (confidence level: 100%)

Havoc botnet C2 server (confidence level: 100%)

DCRat botnet C2 server (confidence level: 100%)

AdaptixC2 botnet C2 server (confidence level: 100%)

Empire Downloader botnet C2 server (confidence level: 100%)

NetSupportManager RAT botnet C2 server (confidence level: 100%)

Lumma Stealer botnet C2 (confidence level: 75%)

XWorm botnet C2 server (confidence level: 100%)

Cobalt Strike botnet C2 domain (confidence level: 75%)

Cobalt Strike botnet C2 server (confidence level: 75%)

Ghost RAT botnet C2 server (confidence level: 75%)

DarkComet botnet C2 server (confidence level: 100%)

AsyncRAT botnet C2 server (confidence level: 100%)

Hook botnet C2 server (confidence level: 100%)

Unknown malware botnet C2 domain (confidence level: 100%)

RedLine Stealer botnet C2 server (confidence level: 100%)

Detailed information about ThreatFox IOCs for 2025-07-08. Get real-time updates, technical details, and mitigation strategies.

ThreatFox IOCs for 2025-07-08 - Live Threat Intelligence - Threat Radar | OffSeq.com

ThreatFox IOCs for 2025-07-08

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.

CVE-2025-4855 is a critical vulnerability affecting the Support Board plugin for WordPress, developed by Schiocco. This vulnerability arises from the use of hardcoded default secrets within the sb_encryption() function across all versions up to and including 3.8.0. The presence of these hardcoded secrets allows unauthenticated attackers to bypass authorization controls and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. Essentially, attackers can manipulate user-controlled keys to gain unauthorized access, enabling them to read, modify, or delete sensitive data managed by the plugin. Furthermore, this vulnerability facilitates exploitation of CVE-2025-4828 and potentially other related functions without requiring any authentication or user interaction. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), indicating a fundamental flaw in how authorization checks are implemented. The CVSS v3.1 score of 9.8 (critical) reflects the high impact on confidentiality, integrity, and availability, combined with ease of exploitation over the network without privileges or user interaction. No patches are currently linked, suggesting that mitigation or updates may not yet be available, increasing the urgency for defensive measures.

Detailed information about CVE-2025-4855: CWE-639 Authorization Bypass Through User-Controlled Key in Schiocco Support Board affecting Schiocco Support Board. G

CVE-2025-4855: CWE-639 Authorization Bypass Through User-Controlled Key in Schiocco Support Board - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4855: CWE-639 Authorization Bypass Through User-Controlled Key in Schiocco Support Board

The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can leverage CVE-2025-4855 vulnerability to exploit this vulnerability unauthenticated.

CVE-2025-4828 is a critical vulnerability affecting the Support Board plugin for WordPress, developed by Schiocco. The vulnerability arises from improper validation of file paths in the sb_file_delete function, which allows an attacker to perform arbitrary file deletion on the server hosting the WordPress site. Specifically, the vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal). This flaw enables attackers to craft malicious requests that bypass directory restrictions and delete sensitive files outside the intended directory scope. Since the vulnerability affects all versions up to and including 3.8.0, any unpatched instance of the plugin is at risk. The impact of arbitrary file deletion is severe, as deleting critical files such as wp-config.php can lead to remote code execution (RCE), effectively allowing attackers to take full control of the affected server. Furthermore, the vulnerability can be exploited without authentication or user interaction, increasing the attack surface and ease of exploitation. The description also references CVE-2025-4855, which can be chained with this vulnerability to facilitate exploitation. The CVSS v3.1 score of 9.8 reflects the critical nature of this vulnerability, with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild, but the potential for exploitation is high given the severity and ease of attack. The lack of available patches at the time of publication underscores the urgency for affected organizations to implement mitigations or workarounds promptly.

Detailed information about CVE-2025-4828: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Schiocco Support Board affect

CVE-2025-4828: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Schiocco Support Board - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4828: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Schiocco Support Board

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and modify the plugin settings, including payment details and API keys

CVE-2025-3780 is a security vulnerability identified in the WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress, developed by wclovers. This vulnerability arises from a missing authorization check (CWE-862) in the function wcfm_redirect_to_setup, which is responsible for redirecting users to the plugin setup interface. Due to the absence of proper capability verification, unauthenticated attackers can exploit this flaw to access and modify sensitive plugin settings without any authentication or user interaction. Specifically, attackers can view and alter critical configuration data such as payment details and API keys. The vulnerability affects all versions up to and including 6.7.16 of the plugin. The CVSS v3.1 base score is 6.5, indicating a medium severity level. The attack vector is network-based (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and impacts confidentiality and integrity but not availability. No known exploits are currently reported in the wild, and no official patches have been released at the time of this analysis. This vulnerability is particularly dangerous because it allows unauthorized modification of financial and integration settings, which could lead to fraudulent transactions, data leakage, or further compromise of the affected WordPress environment.

Detailed information about CVE-2025-3780: CWE-862 Missing Authorization in wclovers WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Lis

CVE-2025-3780: CWE-862 Missing Authorization in wclovers WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-3780: CWE-862 Missing Authorization in wclovers WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible

Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization

This content has been identified as promotional or non-threat material.

Reddit InfoSec News

Detailed information about Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization. Get real-time updates, technical details, and mi

Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Related Threats

CVE-2025-5777, aka CitrixBleed 2, Deep-Dive and Indicators of Compromise

Italian police arrested a Chinese national suspected of cyberespionage on a U.S. warrant

Microsoft Patch Tuesday – July 2025 - Lansweeper

18 Malicious Chrome and Edge Extensions Disguise as Everyday Tools

Android malware Anatsa infiltrates Google Play to target US banks

Actions

External Links

Need enhanced features?

Latest Threats

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility