Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /edit_customer.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

CVE-2025-11471 identifies a SQL injection vulnerability in the SourceCodester Hotel and Lodge Management System version 1.0. The vulnerability exists in the /edit_customer.php script, where the ID parameter is improperly sanitized, allowing attackers to inject malicious SQL code. This injection flaw enables remote attackers to manipulate backend database queries without requiring authentication or user interaction, potentially exposing or altering sensitive customer data stored within the system. The vulnerability is exploitable over the network, increasing its risk profile. The CVSS 4.0 vector indicates no privileges or user interaction are needed, with low complexity and low impact on confidentiality, integrity, and availability individually, but combined they elevate the overall risk. Although no known exploits are currently active in the wild, the public availability of exploit code increases the likelihood of exploitation attempts. The vulnerability affects only version 1.0 of the product, and no official patches have been linked yet, suggesting that users must rely on manual mitigations or vendor updates. This vulnerability is particularly critical for hospitality organizations relying on this system to manage customer data, reservations, and billing, as unauthorized access or data manipulation could result in financial loss, reputational damage, and regulatory non-compliance.

Detailed information about CVE-2025-11471: SQL Injection in SourceCodester Hotel and Lodge Management System affecting SourceCodester Hotel and Lodge Management

CVE-2025-11471: SQL Injection in SourceCodester Hotel and Lodge Management System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-11471: SQL Injection in SourceCodester Hotel and Lodge Management System

A vulnerability was determined in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown part of the file /pages/save_tax.php. Executing manipulation of the argument percentage can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-11404 identifies a SQL injection vulnerability in SourceCodester Hotel and Lodge Management System version 1.0, located in the /pages/save_tax.php script. The vulnerability stems from insufficient input validation of the 'percentage' parameter, which is directly used in SQL queries without proper sanitization or parameterization. This flaw enables remote attackers to inject malicious SQL code, potentially allowing them to read, modify, or delete database records. The attack vector requires no authentication or user interaction, making it accessible to any remote adversary with network access to the application. The CVSS 4.0 score of 5.3 reflects a medium severity, considering the vulnerability's partial impact on confidentiality, integrity, and availability, and the lack of required privileges. Although no exploits have been observed in the wild yet, the public disclosure of the vulnerability increases the risk of exploitation attempts. The affected product is typically deployed in hospitality environments to manage hotel and lodge operations, including tax calculations, reservations, and billing. Exploiting this vulnerability could lead to unauthorized access to sensitive customer data, financial records, or disruption of service availability. The absence of vendor patches or official remediation guidance necessitates immediate defensive measures by users. Organizations should audit their deployments, restrict access to the vulnerable endpoint, implement web application firewalls with SQL injection detection, and apply input validation controls. Additionally, monitoring database logs for anomalous queries can help detect exploitation attempts. Given the product's niche market, the impact is limited to entities using this specific system, but the hospitality sector's reliance on accurate tax and billing data makes this vulnerability significant for affected users.

Detailed information about CVE-2025-11404: SQL Injection in SourceCodester Hotel and Lodge Management System affecting SourceCodester Hotel and Lodge Management

CVE-2025-11404: SQL Injection in SourceCodester Hotel and Lodge Management System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-11404: SQL Injection in SourceCodester Hotel and Lodge Management System

A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /del_curr.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

CVE-2025-11402 is an SQL injection vulnerability identified in version 1.0 of the SourceCodester Hotel and Lodge Management System. The flaw exists in the /del_curr.php script, where the ID parameter is improperly sanitized, allowing attackers to inject malicious SQL queries. This vulnerability can be exploited remotely without authentication or user interaction, making it accessible to a wide range of attackers. The CVSS 4.0 score of 5.3 reflects a medium severity, considering the attack vector is network-based with low attack complexity and no privileges or user interaction required. The impact on confidentiality, integrity, and availability is limited but non-negligible, as attackers can potentially read or modify database records, disrupt operations, or escalate further attacks. No official patches have been linked yet, and while no active exploitation is reported, the public disclosure of the exploit increases the risk of opportunistic attacks. The vulnerability affects only version 1.0 of the product, which is used primarily in hospitality management contexts. The lack of secure coding practices in input validation highlights the need for immediate remediation to prevent SQL injection attacks that could compromise sensitive customer and operational data.

Detailed information about CVE-2025-11402: SQL Injection in SourceCodester Hotel and Lodge Management System affecting SourceCodester Hotel and Lodge Management

CVE-2025-11402: SQL Injection in SourceCodester Hotel and Lodge Management System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-11402: SQL Injection in SourceCodester Hotel and Lodge Management System

A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected is an unknown function of the file /pages/save_curr.php. This manipulation of the argument currcode causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVE-2025-11401 is a SQL injection vulnerability identified in the SourceCodester Hotel and Lodge Management System version 1.0, specifically within the /pages/save_curr.php script. The vulnerability arises from improper handling of the 'currcode' parameter, which is susceptible to SQL injection due to lack of adequate input validation or use of parameterized queries. This flaw allows an unauthenticated remote attacker to manipulate SQL queries executed by the backend database, potentially enabling unauthorized data access, modification, or deletion. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with attack vector being network-based and no user interaction required. The exploit is publicly available, increasing the risk of exploitation despite no current reports of active attacks. The vulnerability impacts confidentiality, integrity, and availability to a limited extent, as the scope is confined to the affected system and the privilege required is low. The absence of patches or vendor advisories necessitates immediate defensive measures by users of this software. Given the critical role of hotel management systems in handling sensitive customer and operational data, exploitation could lead to data breaches, financial fraud, or operational disruptions.

Detailed information about CVE-2025-11401: SQL Injection in SourceCodester Hotel and Lodge Management System affecting SourceCodester Hotel and Lodge Management

CVE-2025-11401: SQL Injection in SourceCodester Hotel and Lodge Management System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-11401: SQL Injection in SourceCodester Hotel and Lodge Management System

A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Performing manipulation of the argument image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2025-11353 identifies a vulnerability in the code-projects Online Hotel Reservation System version 1.0, specifically in the /admin/addgalleryexec.php script. The vulnerability arises from insufficient validation of the 'image' parameter, allowing an attacker to upload arbitrary files without restrictions. This unrestricted file upload can be exploited remotely without user interaction, though it requires low-level privileges, likely meaning an attacker must have some form of authenticated access or leverage a low-privilege account. The lack of proper file type validation or sanitization enables attackers to upload malicious files such as web shells or scripts, which can then be executed on the server. This can lead to remote code execution, data theft, defacement, or further compromise of the affected system. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with the vector showing network attack vector, low attack complexity, no user interaction, and low privileges required. Although no patches are currently linked, the exploit code is publicly available, increasing the urgency for mitigation. The vulnerability affects only version 1.0 of the product, which may limit exposure but still poses a significant risk to organizations using this system in production environments.

Detailed information about CVE-2025-11353: Unrestricted Upload in code-projects Online Hotel Reservation System affecting code-projects Online Hotel Reservation

CVE-2025-11353: Unrestricted Upload in code-projects Online Hotel Reservation System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-11353: Unrestricted Upload in code-projects Online Hotel Reservation System

A vulnerability was determined in SourceCodester Online Hotel Reservation System 1.0. The affected element is an unknown function of the file deleteroominventory.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-10788 is a SQL Injection vulnerability identified in version 1.0 of the SourceCodester Online Hotel Reservation System. The vulnerability exists in the deleteroominventory.php file, specifically in an unknown function that processes the 'ID' argument. An attacker can manipulate this argument to inject malicious SQL code, which the system then executes on the backend database. This type of injection flaw allows an unauthenticated remote attacker to interfere with the queries made to the database, potentially leading to unauthorized data access, data modification, or deletion. The vulnerability requires no authentication or user interaction, and the attack vector is network accessible (remote). The CVSS 4.0 base score is 6.9, indicating a medium severity level, with low impact on confidentiality, integrity, and availability individually but combined impact is moderate. The exploit has been publicly disclosed, increasing the risk of exploitation, although no known exploits in the wild have been reported yet. The vulnerability stems from improper input validation and sanitization of the 'ID' parameter, which is a common cause of SQL injection issues. Since the affected product is a hotel reservation system, the backend database likely contains sensitive customer information, booking details, and possibly payment data, making the impact of exploitation significant in terms of data confidentiality and integrity.

Detailed information about CVE-2025-10788: SQL Injection in SourceCodester Online Hotel Reservation System affecting SourceCodester Online Hotel Reservation Sys

CVE-2025-10788: SQL Injection in SourceCodester Online Hotel Reservation System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-10788: SQL Injection in SourceCodester Online Hotel Reservation System

BIDI Swap: Unmasking the Art of URL Misleading with Bidirectional Text Tricks

Source: https://www.varonis.com/blog/bidi-swap

The 'BIDI Swap' threat exploits the Unicode Bidirectional (BIDI) control characters to manipulate the visual representation of URLs, thereby misleading users about the true destination of a link. This technique leverages the inherent behavior of bidirectional text rendering engines, which reorder characters in mixed left-to-right (LTR) and right-to-left (RTL) scripts to display text correctly. Attackers insert special BIDI control characters into URLs, causing the displayed URL to appear legitimate or familiar while the actual underlying link directs users to malicious or fraudulent sites. This form of attack is a sophisticated phishing vector that bypasses traditional URL inspection by exploiting text rendering rather than technical vulnerabilities in software. It does not require exploiting software bugs but instead abuses how browsers and other applications render text containing mixed-direction characters. The threat is notable because it can deceive users even when security tools analyze URLs, as the underlying characters are valid and the manipulation is visual rather than structural. Although no specific affected software versions or patches are listed, the threat applies broadly to any system or application that displays URLs containing bidirectional text without proper normalization or sanitization. The lack of known exploits in the wild suggests it is currently more of a theoretical or emerging threat, but its potential for phishing and social engineering attacks is significant.

Detailed information about BIDI Swap: Unmasking the Art of URL Misleading with Bidirectional Text Tricks. Get real-time updates, technical details, and mitigati

BIDI Swap: Unmasking the Art of URL Misleading with Bidirectional Text Tricks - Live Threat Intelligence - Threat Radar | OffSeq.com

BIDI Swap: Unmasking the Art of URL Misleading with Bidirectional Text Tricks

Reddit Discussion: BIDI Swap: Unmasking the Art of URL Misleading with Bidirectional Text Tricks

Lab Dookhtegan hacking group disrupts communications on dozens of Iranian ships

Source: https://securityaffairs.com/181737/hacking/lab-dookhtegan-disrupts-comms-iranian-ships.html

The Lab Dookhtegan hacking group has reportedly conducted a cyber campaign targeting maritime communication systems on dozens of Iranian ships. This disruption of communications likely involves interference with satellite or radio communication channels, potentially through cyber intrusions into the ships' onboard communication infrastructure or associated shore-based systems. Although specific technical details such as exploited vulnerabilities, attack vectors, or malware used are not provided, the campaign's impact suggests a capability to interfere with critical maritime communication systems. Such disruptions can affect navigation, safety, and operational coordination of vessels, posing risks to maritime logistics and security. The campaign appears to be a targeted operation against Iranian maritime assets, possibly leveraging cyber-espionage or sabotage techniques to degrade Iran's maritime communication capabilities. The lack of known exploits in the wild and minimal discussion suggests this is a relatively new or low-profile campaign, but the medium severity rating indicates a tangible operational impact. The source of this information is a Reddit post linking to an external security news site, which adds some credibility but also indicates limited publicly available technical details at this time.

Detailed information about Lab Dookhtegan hacking group disrupts communications on dozens of Iranian ships. Get real-time updates, technical details, and mitiga

Lab Dookhtegan hacking group disrupts communications on dozens of Iranian ships - Live Threat Intelligence - Threat Radar | OffSeq.com

Lab Dookhtegan hacking group disrupts communications on dozens of Iranian ships

Reddit Discussion: Lab Dookhtegan hacking group disrupts communications on dozens of Iranian ships

A new Phishing-as-a-Service (PhaaS) framework dubbed Salty 2FA has been discovered targeting industries in the US and EU. It uses a unique domain pattern combining .com subdomains with .ru domains and employs a multi-stage execution chain to resist detection. The kit can bypass multiple 2FA methods, including push, SMS, and voice. Victims span global industries such as finance, telecom, energy, consulting, logistics, and education. Static IOCs are unreliable for detection; instead, behavioral patterns must be identified. The framework shares traits with Storm-1575 but has distinct characteristics setting it apart from known threats like Tycoon2FA or EvilProxy. It demonstrates sophisticated capabilities in distributing phishing payloads, maintaining dynamic infrastructure, and managing complex communication between phishing pages and C2 servers.

Salty 2FA is a recently identified Phishing-as-a-Service (PhaaS) framework targeting industries across the United States and Europe. This sophisticated threat leverages a unique domain pattern that combines .com subdomains with .ru domains, complicating detection efforts based on static indicators of compromise (IOCs). The framework employs a multi-stage execution chain designed to evade traditional security mechanisms and detection tools. Notably, Salty 2FA is capable of bypassing multiple two-factor authentication (2FA) methods, including push notifications, SMS codes, and voice calls, which significantly enhances its ability to compromise accounts protected by 2FA. Victims span a broad range of high-value sectors such as finance, telecommunications, energy, consulting, logistics, and education, indicating a wide attack surface and the targeting of critical infrastructure and sensitive data. 

Salty 2FA shares some operational traits with the Storm-1575 adversary but maintains distinct characteristics that differentiate it from other known phishing frameworks like Tycoon2FA or EvilProxy. Its infrastructure is dynamic, with complex command-and-control (C2) communication protocols that facilitate the distribution of phishing payloads and management of the phishing infrastructure. Due to the dynamic nature of its domains and IP addresses, static IOCs are unreliable for detection; instead, behavioral analysis focusing on the multi-stage execution chain and anomalous network communications is required. Indicators associated with Salty 2FA include IP addresses such as 153.127.234.4, 153.127.234.5, and 191.96.207.129, and domains like marketplace24ei.ru and telephony.nexttradeitaly.com. Although there are no known exploits in the wild at this time, the threat poses a medium-severity risk due to its ability to circumvent 2FA and target critical sectors.

Detailed information about Salty 2FA: Undetected PhaaS Hitting US and EU Industries. Get real-time updates, technical details, and mitigation strategies.

Salty 2FA: Undetected PhaaS Hitting US and EU Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

Salty 2FA: Undetected PhaaS Hitting US and EU Industries

A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/expense.php. The manipulation of the argument expense_for leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-8983 is a SQL Injection vulnerability identified in version 1.0 of the itsourcecode Online Tour and Travel Management System. The vulnerability resides in the /admin/operations/expense.php file, specifically in the handling of the 'expense_for' parameter. An attacker can manipulate this parameter to inject malicious SQL code, which is then executed by the backend database. This flaw allows remote attackers to execute arbitrary SQL commands without requiring authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability impacts the confidentiality, integrity, and availability of the system, as attackers may extract sensitive data, modify or delete records, or disrupt system operations. The CVSS 4.0 base score is 6.9, categorizing it as a medium severity issue. Although no known exploits are currently reported in the wild, the exploit details have been publicly disclosed, increasing the risk of exploitation. The vulnerability does not require any privileges or user interaction, making it easier to exploit remotely over the network. The lack of scope change (S:U) means the impact is limited to the vulnerable component but still significant given the nature of the application managing sensitive travel and financial data. The vulnerability's presence in an administrative module suggests that successful exploitation could lead to unauthorized access or manipulation of financial expense records, potentially impacting business operations and data privacy.

Detailed information about CVE-2025-8983: SQL Injection in itsourcecode Online Tour and Travel Management System affecting itsourcecode Online Tour and Travel M

Title	Severity	Type	Source	Date

Threats Affecting Greece

Filter Threats

Scan a website for live threats in under a minute

Threats Affecting Greece

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility