Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month

Source: https://thehackernews.com/2025/06/over-269000-websites-infected-with.html

In June 2025, a significant malware campaign involving the JSFireTruck JavaScript malware was reported, infecting over 269,000 websites within a single month. JSFireTruck is a malicious JavaScript payload that is typically injected into vulnerable websites to execute unauthorized scripts on visitors' browsers. This malware often serves as a delivery mechanism for further attacks such as drive-by downloads, cryptojacking, data theft, or redirecting users to phishing or exploit sites. The infection vector commonly involves exploiting vulnerabilities in website content management systems (CMS), third-party plugins, or weak administrative credentials, allowing attackers to insert the malicious JavaScript code into web pages. Once embedded, the malware executes client-side, potentially compromising the confidentiality and integrity of user data, degrading website availability, and damaging the reputation of the affected sites. The rapid scale of infection—over a quarter million sites in just one month—indicates either automated mass exploitation or widespread vulnerabilities in popular web platforms. Although no specific affected versions or CVEs are identified, the malware's propagation suggests a broad attack surface, possibly targeting common web technologies such as WordPress, Joomla, or Drupal. No known exploits in the wild are explicitly documented, but the high infection count implies active exploitation. The minimal discussion level and limited technical details from the source (a Reddit InfoSecNews post referencing TheHackerNews) highlight the need for further investigation and monitoring. Given the nature of JavaScript malware, the threat primarily impacts web server integrity and client-side security, with potential downstream effects on user trust and compliance with data protection regulations.

Detailed information about Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month. Get real-time updates, technical details, and mitiga

Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month - Live Threat Intelligence - Threat Radar | OffSeq.com

Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month

Reddit Discussion: Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.

CVE-2025-48920 is a Cross-Site Scripting (XSS) vulnerability identified in the Drupal etracker module, affecting versions prior to 3.1.0 (notably from version 0.0.0 before 3.1.0). The vulnerability arises due to improper neutralization of input during web page generation, classified under CWE-79. This means that user-supplied input is not correctly sanitized or encoded before being embedded into web pages, allowing an attacker to inject malicious scripts. When a victim accesses a compromised page, the injected script can execute in the context of the victim's browser, potentially leading to session hijacking, credential theft, unauthorized actions on behalf of the user, or redirection to malicious sites. The etracker module is used within Drupal to integrate web analytics and tracking functionalities, which often involves processing user input or query parameters. The lack of a patch or fix at the time of publication indicates that the vulnerability remains unmitigated. No known exploits are currently reported in the wild, but the nature of XSS vulnerabilities makes them attractive targets for attackers due to their relative ease of exploitation and potential impact on user trust and data confidentiality. The vulnerability does not require authentication or complex user interaction beyond visiting a crafted URL or page. Since Drupal is a widely used content management system (CMS) in Europe, especially among public sector and enterprise websites, the exposure risk is significant wherever the etracker module is deployed without updates.

Detailed information about CVE-2025-48920: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal etracker affect

CVE-2025-48920: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal etracker - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48920: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal etracker

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

CVE-2025-48919 is a Cross-Site Scripting (XSS) vulnerability classified under CWE-79, affecting the Drupal Simple Klaro module versions prior to 1.10.0, specifically from version 0.0.0 up to but not including 1.10.0. Simple Klaro is a Drupal module used to integrate the Klaro consent management platform, which manages user consent for cookies and tracking technologies on websites. The vulnerability arises due to improper neutralization of input during web page generation, meaning that user-supplied input is not correctly sanitized or encoded before being included in the HTML output. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users. When exploited, the malicious script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability does not require authentication or user interaction beyond visiting a crafted URL or page containing the malicious payload. Although no known exploits are currently reported in the wild, the nature of XSS vulnerabilities makes them attractive for attackers due to ease of exploitation and potential for widespread impact. The absence of a CVSS score indicates that the vulnerability is newly disclosed and has not yet undergone formal severity assessment. The vulnerability affects all Drupal sites using Simple Klaro versions before 1.10.0, which may include a broad range of public-facing websites, especially those in Europe where Drupal is widely adopted for government, educational, and commercial websites. Since Simple Klaro handles consent management, exploitation could also undermine compliance with privacy regulations by manipulating consent dialogs or stealing sensitive user data. No patches or fixes are currently linked, so immediate mitigation requires manual intervention or disabling the module until an update is available.

Detailed information about CVE-2025-48919: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal Simple Klaro af

CVE-2025-48919: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal Simple Klaro - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48919: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal Simple Klaro

This intelligence report emphasizes the importance of understanding one's own environment and personal weaknesses in cybersecurity. It stresses the need for repeatable processes to maintain knowledge of one's environment and advocates for continuous learning to fill skill gaps. The report also highlights recent vulnerability disclosures by Cisco Talos across various software, including catdoc, Parallel, NVIDIA, and High-Logic FontCreator. It underscores the significance of promptly applying patches and remaining vigilant against potential exploits. Additionally, the report touches on recent cyber incidents affecting the NHS, United Natural Foods, and vulnerabilities in Google accounts and SinoTrack GPS devices.

The intelligence report titled "Know thyself, know thy environment" emphasizes the critical importance of comprehensive self-awareness in cybersecurity posture management. It advocates for organizations to implement repeatable processes that maintain an up-to-date understanding of their IT environments, including hardware, software, and network configurations, as well as personnel skill levels. The report highlights recent vulnerability disclosures by Cisco Talos affecting multiple software products such as catdoc (a document converter), Parallel (likely referring to Parallels virtualization software), NVIDIA drivers or software components, and High-Logic FontCreator (a font editing tool). These vulnerabilities, if left unpatched, could be exploited to compromise confidentiality, integrity, or availability of systems. The report also references recent cyber incidents impacting high-profile organizations including the UK's National Health Service (NHS), United Natural Foods, and vulnerabilities in Google accounts and SinoTrack GPS devices, underscoring the broad attack surface and the diversity of targets. The tags associated with the report indicate concerns about ransomware (notably techniques like T1486 - Data Encrypted for Impact), critical infrastructure targeting, GPS vulnerabilities, and malware families such as Qilin and PathWiper. The MITRE ATT&CK techniques tagged (e.g., T1489 - Service Stop, T1082 - System Information Discovery, T1190 - Exploit Public-Facing Application, T1059 - Command and Scripting Interpreter) suggest adversaries may leverage exploitation of public-facing applications, reconnaissance, lateral movement, and destructive actions. Although no known exploits are currently observed in the wild for these disclosed vulnerabilities, the report stresses the urgency of patch management and continuous vigilance to prevent exploitation. The inclusion of hash indicators suggests malware samples or related files associated with the threat, useful for detection and response efforts. Overall, this report serves as a strategic reminder that understanding one's environment and promptly addressing vulnerabilities through patching and skill development are foundational to effective cybersecurity defense.

Detailed information about Know thyself, know thy environment. Get real-time updates, technical details, and mitigation strategies.

Know thyself, know thy environment - Live Threat Intelligence - Threat Radar | OffSeq.com

Know thyself, know thy environment

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

CVE-2025-22239 is a high-severity vulnerability affecting VMware SALT, specifically versions 3006.x and 3007.x. The vulnerability resides in the Salt Master's "_minion_event" method, which is responsible for handling events sent by authorized minions. An authorized minion can exploit this flaw to inject arbitrary events onto the Salt Master's event bus. This event bus is a critical communication channel within the Salt infrastructure, used for orchestrating commands, monitoring, and automation tasks. By injecting arbitrary events, an attacker with high privileges on a minion can manipulate the Salt Master's behavior, potentially triggering unauthorized actions, disrupting normal operations, or escalating privileges. The CVSS 3.1 base score of 8.1 reflects the vulnerability's high impact on confidentiality and integrity, with a limited impact on availability. The vector indicates that the attack requires local access (AV:L), low attack complexity (AC:L), and high privileges (PR:H) but does not require user interaction (UI:N). The scope is changed (S:C), meaning the vulnerability affects resources beyond the initially vulnerable component. Although no known exploits are currently reported in the wild, the vulnerability's nature and the critical role of Salt Masters in infrastructure management make it a significant risk. The vulnerability was published on June 13, 2025, and no official patches or mitigations are listed yet, emphasizing the need for immediate attention by affected organizations.

Detailed information about CVE-2025-22239: Vulnerability in VMware SALT affecting VMware SALT. Get real-time updates, technical details, and mitigation strategi

CVE-2025-22239: Vulnerability in VMware SALT - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-22239: Vulnerability in VMware SALT

gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 0.3.7.

CVE-2025-31128 is a medium-severity cross-site scripting (XSS) vulnerability identified in the 'gifplayer' jQuery plugin developed by rubentd. Gifplayer is a customizable plugin designed to control the playback of animated GIFs on web pages, allowing users to play and stop animations interactively. The vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79, which means that user-supplied input is not correctly sanitized or encoded before being included in the HTML output. This flaw enables an attacker to inject malicious scripts into web pages that use vulnerable versions of gifplayer (versions prior to 0.3.7). According to the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N), the vulnerability can be exploited remotely over the network without any authentication or user interaction, with low attack complexity and no requirement for privileges. The impact primarily affects the confidentiality and integrity of the affected web applications by allowing script execution in the context of the victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of the user. The vulnerability has been fixed in version 0.3.7 of gifplayer. There are no known exploits in the wild at the time of publication (March 31, 2025).

Detailed information about CVE-2025-31128: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rubentd gifplayer aff

CVE-2025-31128: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rubentd gifplayer - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-31128: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rubentd gifplayer

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.

CVE-2025-49578 is a cross-site scripting (XSS) vulnerability identified in the Citizen skin for MediaWiki, developed by StarCitizenTools. This skin integrates various extensions to provide a cohesive user experience. The vulnerability arises from improper neutralization of input during web page generation, specifically related to how date messages returned by the `Language::userDate` function are handled. These date messages are inserted directly into raw HTML without sufficient sanitization or encoding, allowing an attacker with the ability to edit these messages to inject arbitrary HTML and JavaScript code into the Document Object Model (DOM) of affected wikis. The vulnerability impacts wikis where a user group possesses the `editinterface` permission but lacks the `editsitejs` permission. This permission configuration allows attackers to modify interface messages but restricts them from editing site-wide JavaScript, which could otherwise be used for similar attacks. The vulnerability affects versions of the Citizen skin from commit 64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb up to but not including 93c36ac778397e0e7c46cf7adb1e5d848265f1bd, and specifically versions 3.3.0 up to but not including 3.3.1. The issue was publicly disclosed on June 12, 2025, and is assigned a CVSS v3.1 score of 6.5, indicating a medium severity level. The attack vector is network-based, requiring high privileges (editinterface permission) but no user interaction. The vulnerability impacts confidentiality and integrity by allowing script injection, but does not affect availability. No known exploits are currently reported in the wild, and no official patches are linked, although the issue is fixed in version 3.3.1 of the Citizen skin.

Detailed information about CVE-2025-49578: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in StarCitizenTools medi

CVE-2025-49578: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in StarCitizenTools mediawiki-skins-Citizen - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49578: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in StarCitizenTools mediawiki-skins-Citizen

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

CVE-2025-22874 is a vulnerability identified in the Go standard library's crypto/x509 package, specifically related to improper certificate validation (CWE-295). The issue arises when the Verify function is called with VerifyOptions.KeyUsages containing ExtKeyUsageAny. Under these conditions, the policy validation step is unintentionally disabled for certificate chains that include policy graphs. Certificate policy graphs are a mechanism used in X.509 certificates to specify the policies under which a certificate is considered valid. While such policy graphs are uncommon, their presence is critical in environments requiring strict certificate policy enforcement. The flaw means that when ExtKeyUsageAny is specified, the verification process does not enforce the intended certificate policies, potentially allowing certificates that do not meet the required policy constraints to be accepted as valid. This could lead to acceptance of certificates that should otherwise be rejected, undermining the trust model of TLS or other cryptographic protocols relying on Go's crypto/x509 package for certificate validation. The affected versions include Go standard library versions from 0 up to 1.24.0-0. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The vulnerability was published on June 11, 2025, and was reserved earlier in January 2025. The absence of patch links suggests that fixes may be pending or not yet widely disseminated at the time of this report.

Detailed information about CVE-2025-22874: CWE-295: Improper Certificate Validation in Go standard library crypto/x509 affecting Go standard library crypto/x509

CVE-2025-22874: CWE-295: Improper Certificate Validation in Go standard library crypto/x509 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-22874: CWE-295: Improper Certificate Validation in Go standard library crypto/x509

A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root.
*This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.28.0 < (macOS).

CVE-2025-5687 is a local privilege escalation vulnerability affecting Mozilla VPN clients on macOS, specifically versions 2.28.0 and earlier. This vulnerability allows a local attacker with normal user privileges to escalate their privileges to root, effectively gaining full administrative control over the affected system. The issue is confined to the macOS platform and does not impact Mozilla VPN clients on other operating systems. The vulnerability arises from improper handling of privilege boundaries within the Mozilla VPN client software, potentially due to insecure execution of privileged operations or inadequate validation of user inputs or permissions. Exploiting this flaw requires local access to the machine, meaning an attacker must already have a foothold as a standard user. There are no known exploits in the wild at the time of publication, and no official patches or mitigation links have been provided yet. The absence of a CVSS score suggests that the vulnerability is newly disclosed and under evaluation. However, the ability to escalate privileges to root on a macOS system is a significant security risk, as it compromises the confidentiality, integrity, and availability of the system and any data or services running on it. Given that Mozilla VPN is used to secure network traffic, an attacker gaining root access could also manipulate VPN configurations, intercept or redirect traffic, or disable security controls, further exacerbating the threat.

Detailed information about CVE-2025-5687: Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below. in Mozilla Mozilla VPN 2.

CVE-2025-5687: Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below. in Mozilla Mozilla VPN 2.28.0 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-5687: Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below. in Mozilla Mozilla VPN 2.28.0

SunGrow's back end users system  iSolarCloud https://isolarcloud.com  uses an MQTT service to transport data from the user's connected devices to the user's web browser. 
The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. 
While the data that is transmitted through the MQTT server is encrypted and the credentials for the MQTT server are obtained though an API call, the credentials could be used to subscribe to any topic and the encryption key can be used to decrypt all messages received.
An attack with an account on iSolarCloud.com could extract MQTT credentials and the decryption key from the browser and then use an external program to subscribe to the topic '#' and thus recieve all messages from all connected devices.

CVE-2025-29756 is a high-severity vulnerability (CWE-862: Missing Authorization) affecting SunGrow's iSolarCloud backend user system, which is used to manage data from connected solar energy devices. The system employs an MQTT (Message Queuing Telemetry Transport) service to transport data from user devices to the user's web browser. MQTT is a lightweight messaging protocol commonly used in IoT environments for real-time data transmission. In this case, the MQTT server does not enforce sufficient authorization controls on topic subscriptions. Although the MQTT credentials are obtained via an API call and the transmitted data is encrypted, any authenticated user with an iSolarCloud account can extract these MQTT credentials and the encryption key directly from their browser. With these credentials, an attacker can subscribe to the MQTT topic wildcard '#', which grants access to all messages from all connected devices across the platform. This means that an attacker can intercept and decrypt data streams from any user’s devices, leading to a significant breach of confidentiality. The vulnerability does not require user interaction beyond having an authenticated account, and no additional privileges are needed beyond standard user access. The CVSS 4.0 score is 8.3 (high), reflecting the network attack vector, low attack complexity, no required privileges beyond authentication, no user interaction, and a high impact on confidentiality. The vulnerability affects all versions of iSolarCloud as indicated. No patches or known exploits in the wild have been reported yet. The root cause is insufficient authorization checks on MQTT topic subscriptions, allowing lateral data access across users. This vulnerability could be exploited by malicious insiders or external attackers who have compromised user credentials, enabling them to eavesdrop on sensitive operational data from solar energy installations managed via iSolarCloud.

Detailed information about CVE-2025-29756: CWE-862 Missing Authorization in SunGrow iSolarCloud affecting SunGrow iSolarCloud. Get real-time updates, technical 

Title	Severity	Type	Source	Date

Threats Affecting Denmark

Filter Threats

Threats Affecting Denmark