A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/common.php of the component PHP Object Handler. The manipulation of the argument rememberMe leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7216 is a deserialization vulnerability identified in the lty628 Aidigu software versions up to 1.8.2, specifically affecting the checkUserCookie function within the /application/common.php file. The vulnerability arises from improper handling of the 'rememberMe' argument, which is deserialized without adequate validation or sanitization. This flaw allows an attacker to remotely supply crafted serialized data to the PHP Object Handler component, triggering unsafe deserialization. Exploiting this vulnerability can lead to arbitrary code execution or other malicious actions, as deserialization vulnerabilities often allow attackers to manipulate application logic or execute injected payloads. The vulnerability is remotely exploitable without requiring authentication or user interaction, increasing its risk profile. The CVSS v4.0 score is 6.9, categorized as medium severity, reflecting the network attack vector, low complexity, and no privileges or user interaction needed. However, the impact on confidentiality, integrity, and availability is rated low, suggesting limited direct damage but still significant due to the potential for remote code execution. Although no public exploits are currently known in the wild, the exploit details have been disclosed publicly, increasing the likelihood of future exploitation. No official patches or mitigations have been linked yet, indicating that affected organizations must proactively implement defensive measures. The vulnerability's presence in a PHP-based web application component makes it particularly relevant for environments relying on Aidigu for user session management or authentication persistence.

CVE Database V5

Detailed information about CVE-2025-7216: Deserialization in lty628 Aidigu affecting lty628 Aidigu. Get real-time updates, technical details, and mitigation str

CVE-2025-7216: Deserialization in lty628 Aidigu - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7216: Deserialization in lty628 Aidigu

A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of the file /rom/wpa_supplicant.conf. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

CVE-2025-7215 is a vulnerability identified in the FNKvision FNK-GU2 device firmware versions up to 40.1.7. The issue involves the cleartext storage of sensitive information within the file /rom/wpa_supplicant.conf. This file is typically associated with Wi-Fi configuration and may contain credentials or keys used for wireless network authentication. The vulnerability arises from improper handling or storage of this sensitive data, allowing an attacker with physical access to the device to extract confidential information directly from the device's storage. The attack complexity is rated as high, indicating that exploitation requires specialized skills and physical access to the device, and no remote exploitation vector is indicated. The vulnerability does not require user interaction but does require high privileges (likely administrative or root level) on the device to access the sensitive file. The CVSS 4.0 base score is 1.0, reflecting a low severity due to limited attack surface and difficulty in exploitation. There are no known exploits in the wild, and no patches or mitigation links have been provided at the time of publication. The vulnerability disclosure is public, which means that threat actors could potentially develop exploits in the future. The vulnerability primarily impacts confidentiality, as sensitive information stored in cleartext could be extracted, but it does not affect integrity or availability of the device or network services directly.

Detailed information about CVE-2025-7215: Cleartext Storage of Sensitive Information in FNKvision FNK-GU2 affecting FNKvision FNK-GU2. Get real-time updates, te

CVE-2025-7215: Cleartext Storage of Sensitive Information in FNKvision FNK-GU2 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7215: Cleartext Storage of Sensitive Information in FNKvision FNK-GU2

A vulnerability classified as problematic was found in FNKvision FNK-GU2 up to 40.1.7. Affected by this vulnerability is an unknown functionality of the file /etc/shadow of the component MD5. The manipulation leads to risky cryptographic algorithm. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

CVE-2025-7214 is a vulnerability identified in the FNKvision FNK-GU2 product series up to version 40.1.7. The issue stems from the use of a risky cryptographic algorithm related to the MD5 hashing function within an unknown functionality involving the /etc/shadow file. The /etc/shadow file typically stores hashed user password information on Unix-like systems, and the use of MD5, a deprecated and cryptographically weak hashing algorithm, exposes the system to potential cryptographic weaknesses. Although the exact nature of the vulnerability's exploitation vector is not fully detailed, it is noted that an attacker requires physical access to the device to launch an attack. The attack complexity is high, indicating that exploitation is difficult and likely requires specialized knowledge or conditions. The vulnerability does not require user interaction, but it does require high privileges (authentication with elevated rights) to exploit. The CVSS 4.0 base score is 1.0, reflecting a low severity rating primarily due to the limited attack vector (physical access) and high attack complexity. The vulnerability has been publicly disclosed, but no known exploits are currently active in the wild. The risk arises from the continued use of MD5, which is vulnerable to collision and preimage attacks, potentially allowing attackers with physical access to compromise password hashes or related authentication mechanisms, undermining confidentiality and integrity of credentials stored on the device.

Detailed information about CVE-2025-7214: Risky Cryptographic Algorithm in FNKvision FNK-GU2 affecting FNKvision FNK-GU2. Get real-time updates, technical detai

CVE-2025-7214: Risky Cryptographic Algorithm in FNKvision FNK-GU2 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7214: Risky Cryptographic Algorithm in FNKvision FNK-GU2

The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-7059 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Simple Featured Image WordPress plugin developed by jdegayojr. This vulnerability affects all versions up to and including 1.3.1. The root cause is improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'slideshow' parameter. An authenticated attacker with Contributor-level privileges or higher can exploit this flaw by injecting arbitrary malicious scripts into pages managed by the plugin. These scripts are then stored persistently and executed in the context of any user who views the compromised page, potentially leading to session hijacking, privilege escalation, or other malicious activities. The vulnerability has a CVSS 3.1 base score of 6.4, categorized as medium severity, reflecting its network attack vector, low attack complexity, and requirement for privileges but no user interaction. The scope is changed (S:C), indicating that the vulnerability can affect resources beyond the initially vulnerable component. No known exploits are currently reported in the wild, and no official patches have been linked yet. This vulnerability falls under CWE-79, highlighting the classic XSS issue of improper input validation and output encoding in web applications.

Detailed information about CVE-2025-7059: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in jdegayojr Simple Featur

CVE-2025-7059: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in jdegayojr Simple Featured Image - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7059: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in jdegayojr Simple Featured Image

The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

CVE-2025-4606 is a critical security vulnerability identified in the Sala - Startup & SaaS WordPress Theme developed by uxper. This vulnerability is classified under CWE-620, which pertains to unverified password changes. The core issue lies in the theme's failure to properly validate a user's identity before allowing updates to sensitive account details, specifically passwords. This flaw affects all versions of the theme up to and including version 1.1.4. Because of this lack of authentication and validation, an unauthenticated attacker can exploit the vulnerability to change the password of any user account, including those with administrative privileges. This effectively allows the attacker to escalate privileges and gain unauthorized access to the WordPress site. The vulnerability is remotely exploitable without any user interaction or prior authentication, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The impact on confidentiality, integrity, and availability is severe, with the attacker able to fully compromise the affected system. Although no known exploits have been reported in the wild yet, the high CVSS score of 9.8 underscores the critical nature of this vulnerability. The absence of a patch at the time of reporting further increases the urgency for mitigation. This vulnerability is particularly dangerous because WordPress themes are widely used and often trusted components, and a compromised administrative account can lead to complete site takeover, data theft, defacement, or use of the site as a launchpad for further attacks.

Detailed information about CVE-2025-4606: CWE-620 Unverified Password Change in uxper Sala - Startup & SaaS WordPress Theme affecting uxper Sala - Startup & Saa

CVE-2025-4606: CWE-620 Unverified Password Change in uxper Sala - Startup & SaaS WordPress Theme - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4606: CWE-620 Unverified Password Change in uxper Sala - Startup & SaaS WordPress Theme

Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization

This content has been identified as promotional or non-threat material.

Reddit InfoSec News

Detailed information about Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization. Get real-time updates, technical details, and mi

Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Scattered Spider: Understanding Help Desk Scams and How to Defend Your Organization

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Related Threats

Bypassing Live HTML Filtering to Trigger Stored XSS – DOM-Based Exploitation

CVE-2025-5777, aka CitrixBleed 2, Deep-Dive and Indicators of Compromise

Italian police arrested a Chinese national suspected of cyberespionage on a U.S. warrant

Microsoft Patch Tuesday – July 2025 - Lansweeper

18 Malicious Chrome and Edge Extensions Disguise as Everyday Tools

Actions

External Links

Need enhanced features?

Latest Threats

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility