Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new Phishing-as-a-Service (PhaaS) framework dubbed Salty 2FA has been discovered targeting industries in the US and EU. It uses a unique domain pattern combining .com subdomains with .ru domains and employs a multi-stage execution chain to resist detection. The kit can bypass multiple 2FA methods, including push, SMS, and voice. Victims span global industries such as finance, telecom, energy, consulting, logistics, and education. Static IOCs are unreliable for detection; instead, behavioral patterns must be identified. The framework shares traits with Storm-1575 but has distinct characteristics setting it apart from known threats like Tycoon2FA or EvilProxy. It demonstrates sophisticated capabilities in distributing phishing payloads, maintaining dynamic infrastructure, and managing complex communication between phishing pages and C2 servers.

Salty 2FA is a newly identified Phishing-as-a-Service (PhaaS) framework actively targeting industries across the United States and Europe. This threat is notable for its sophisticated multi-stage execution chain designed to evade traditional detection mechanisms. Salty 2FA employs a unique domain pattern that combines .com subdomains with .ru domains, complicating static indicator of compromise (IOC) detection. The framework is capable of bypassing multiple forms of two-factor authentication (2FA), including push notifications, SMS codes, and voice calls, which significantly increases its effectiveness against organizations relying on 2FA for security. Victims span a broad range of sectors such as finance, telecommunications, energy, consulting, logistics, and education, indicating a wide attack surface and high-value targets. Unlike other phishing frameworks like Tycoon2FA or EvilProxy, Salty 2FA shares some traits with the Storm-1575 adversary but maintains distinct operational characteristics, including dynamic infrastructure management and complex command-and-control (C2) communication protocols. Detection efforts must focus on behavioral analysis rather than static IOCs due to the framework's use of dynamic domains and IPs. Indicators include several IP addresses (e.g., 153.127.234.4, 153.127.234.5, 191.96.207.129) and domains such as marketplace24ei.ru and telephony.nexttradeitaly.com, which are part of the phishing infrastructure. The threat does not currently have known exploits in the wild but represents a medium-severity risk due to its capability to circumvent 2FA and target critical industries.

Detailed information about Salty 2FA: Undetected PhaaS Hitting US and EU Industries. Get real-time updates, technical details, and mitigation strategies.

Salty 2FA: Undetected PhaaS Hitting US and EU Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

Salty 2FA: Undetected PhaaS Hitting US and EU Industries

A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/expense.php. The manipulation of the argument expense_for leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-8983 is a SQL Injection vulnerability identified in version 1.0 of the itsourcecode Online Tour and Travel Management System. The vulnerability resides in the /admin/operations/expense.php file, specifically in the handling of the 'expense_for' parameter. An attacker can manipulate this parameter to inject malicious SQL code, which is then executed by the backend database. This flaw allows remote attackers to execute arbitrary SQL commands without requiring authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability impacts the confidentiality, integrity, and availability of the system, as attackers may extract sensitive data, modify or delete records, or disrupt system operations. The CVSS 4.0 base score is 6.9, categorizing it as a medium severity issue. Although no known exploits are currently reported in the wild, the exploit details have been publicly disclosed, increasing the risk of exploitation. The vulnerability does not require any privileges or user interaction, making it easier to exploit remotely over the network. The lack of scope change (S:U) means the impact is limited to the vulnerable component but still significant given the nature of the application managing sensitive travel and financial data. The vulnerability's presence in an administrative module suggests that successful exploitation could lead to unauthorized access or manipulation of financial expense records, potentially impacting business operations and data privacy.

Detailed information about CVE-2025-8983: SQL Injection in itsourcecode Online Tour and Travel Management System affecting itsourcecode Online Tour and Travel M

CVE-2025-8983: SQL Injection in itsourcecode Online Tour and Travel Management System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-8983: SQL Injection in itsourcecode Online Tour and Travel Management System

A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/payment.php. The manipulation of the argument payment_type leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-8981 is a SQL Injection vulnerability identified in version 1.0 of the itsourcecode Online Tour and Travel Management System. The flaw exists in the /admin/operations/payment.php file, specifically through the manipulation of the 'payment_type' parameter. This parameter is not properly sanitized or validated, allowing an attacker to inject malicious SQL code remotely without any authentication or user interaction. Exploiting this vulnerability could enable an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or deletion. The vulnerability has been publicly disclosed, increasing the risk of exploitation, although no known exploits are currently reported in the wild. The CVSS v4.0 base score is 6.9, indicating a medium severity level. The attack vector is network-based with low attack complexity and no privileges or user interaction required. The vulnerability impacts confidentiality, integrity, and availability to a limited extent due to the partial impact metrics (low to medium). Since the affected software is a niche online tour and travel management system, the scope of affected systems is limited to organizations using this specific product version.

Detailed information about CVE-2025-8981: SQL Injection in itsourcecode Online Tour and Travel Management System affecting itsourcecode Online Tour and Travel M

CVE-2025-8981: SQL Injection in itsourcecode Online Tour and Travel Management System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-8981: SQL Injection in itsourcecode Online Tour and Travel Management System

Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.

CVE-2025-51536 identifies a security vulnerability in the Austrian Archaeological Institute's OpenAtlas software version 8.11.0, specifically the presence of a hardcoded administrator password. OpenAtlas is a specialized software platform used for archaeological data management and research documentation. The hardcoded password means that the administrator account credentials are embedded directly into the software code or configuration, and cannot be changed by the user. This creates a significant security risk because if the password becomes publicly known or is discovered by an attacker, unauthorized parties can gain administrative access to the system without needing to exploit other vulnerabilities or perform complex attacks. Administrative access typically grants full control over the application, including the ability to view, modify, or delete sensitive archaeological data, alter configurations, and potentially pivot to other systems within the network. The vulnerability does not have an assigned CVSS score and no known exploits in the wild have been reported as of the publication date. However, the presence of a hardcoded password is a well-known security anti-pattern that can lead to severe compromise if exploited. The lack of patch links suggests that a fix or update addressing this issue may not yet be available or publicly disclosed. Given the specialized nature of OpenAtlas, the vulnerability primarily affects organizations using this software, which are likely to be academic, research, or cultural heritage institutions focused on archaeology. The technical details confirm the vulnerability was reserved in June 2025 and published in August 2025, indicating recent discovery and disclosure.

Detailed information about CVE-2025-51536: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-51536: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-51536: n/a

A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/add-boat.php. The manipulation of the argument boatname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-8431 is a critical SQL Injection vulnerability identified in version 1.0 of the PHPGurukul Boat Booking System, specifically within the /admin/add-boat.php file. The vulnerability arises from improper sanitization or validation of the 'boatname' parameter, which is directly used in SQL queries without adequate protection. This flaw allows an unauthenticated remote attacker to inject malicious SQL code, potentially manipulating the backend database. The attack vector requires no authentication or user interaction, making exploitation straightforward. The vulnerability can lead to unauthorized data disclosure, modification, or deletion, compromising the confidentiality, integrity, and availability of the affected system's data. Although no public exploits are currently known in the wild, the vulnerability has been publicly disclosed, increasing the risk of exploitation by threat actors. The CVSS 4.0 score is 6.9 (medium severity), reflecting the ease of exploitation and the impact on data confidentiality, integrity, and availability, albeit with limited scope and no requirement for privileges or user interaction. The vulnerability affects only version 1.0 of the PHPGurukul Boat Booking System, a niche web application used for managing boat bookings, likely deployed by small to medium enterprises or tourism-related businesses. The lack of available patches or mitigations from the vendor increases the urgency for organizations to implement compensating controls.

Detailed information about CVE-2025-8431: SQL Injection in PHPGurukul Boat Booking System affecting PHPGurukul Boat Booking System. Get real-time updates, techn

CVE-2025-8431: SQL Injection in PHPGurukul Boat Booking System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-8431: SQL Injection in PHPGurukul Boat Booking System

The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.

CVE-2025-8286 is a critical vulnerability affecting all versions of the Güralp FMUS Series devices produced by Güralp Systems. The root cause is a missing authentication mechanism on a Telnet-based command line interface (CLI) exposed by these devices. This unauthenticated access allows any attacker with network access to the device to execute critical commands without any credentials. Exploitation of this vulnerability enables an attacker to modify hardware configurations, manipulate or falsify data collected or processed by the device, or perform a factory reset, effectively disrupting device operations and potentially causing loss of critical monitoring data. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), indicating that the device fails to enforce authentication controls on sensitive functions. The CVSS v3.1 base score is 9.3 (critical), reflecting the high impact on confidentiality, integrity, and availability, combined with the ease of exploitation (network attack vector, no privileges or user interaction required). The affected devices are typically used in seismic monitoring and geophysical data collection, which are critical infrastructure components in scientific research and national security contexts. The lack of authentication on a Telnet interface is particularly concerning given Telnet’s inherent lack of encryption, increasing the risk of interception and manipulation by attackers. No patches or mitigations have been published at the time of this report, and no known exploits are currently in the wild, but the vulnerability’s severity and ease of exploitation make it a significant threat to organizations relying on these devices.

Detailed information about CVE-2025-8286: CWE-306 in Güralp Systems Güralp FMUS Series Seismic Monitoring Devices affecting Güralp Systems Güralp FMUS Series Se

CVE-2025-8286: CWE-306 in Güralp Systems Güralp FMUS Series Seismic Monitoring Devices - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-8286: CWE-306 Missing Authentication for Critical Function in Güralp Systems Güralp FMUS Series

A resurgence of malware deploying XMRig cryptominer was discovered in mid-April 2025, coinciding with a rally in Monero cryptocurrency value. The malware uses a multi-staged approach and LOLBAS techniques, leveraging Windows tools like PowerShell for payload delivery, detection evasion, and persistence. The attack chain involves three stages: initial infection via a batch file, persistence establishment, and cryptomining execution. The malware targets diverse countries, including Russia, Belgium, Greece, and China. It disables Windows Update services, evades Windows Defender, and uses scheduled tasks for persistence. The XMRig miner creates registry entries and drops files for continued operation. Despite its simple, unobfuscated nature, the malware proved effective in avoiding detection.

The threat described is a resurgence of malware deploying the XMRig cryptominer, discovered in mid-April 2025, coinciding with an increase in the value of the Monero cryptocurrency. This malware uses a multi-stage infection chain and Living Off the Land Binaries and Scripts (LOLBAS) techniques, leveraging legitimate Windows tools such as PowerShell to deliver payloads, evade detection, and maintain persistence. The attack chain consists of three stages: initial infection via a batch file, establishment of persistence through scheduled tasks and registry modifications, and execution of the XMRig cryptominer to mine Monero. The malware disables Windows Update services to prevent system patches, evades Windows Defender detection mechanisms, and uses scheduled tasks to ensure continued operation after reboots. It creates registry entries and drops files to maintain persistence and continued cryptomining activity. Despite the malware’s relatively simple and unobfuscated code, it effectively avoids detection by abusing legitimate system tools and disabling security features. The malware has been observed targeting multiple countries, including Russia, Belgium, Greece, and China. Indicators of compromise include specific file hashes and a domain (notif.su) used in the attack infrastructure. The malware’s tactics align with several MITRE ATT&CK techniques such as T1053.005 (Scheduled Task), T1489 (Service Stop), T1059.001 (PowerShell), and others related to persistence, defense evasion, and execution. No known exploits or threat actors are currently linked to this malware, and no CVE identifiers are assigned. The overall severity is assessed as medium by the source, reflecting its impact and ease of detection avoidance but limited direct destructive capabilities.

Detailed information about Digging Gold with a Spoon – Resurgence of Monero-mining Malware. Get real-time updates, technical details, and mitigation strategies.

Digging Gold with a Spoon – Resurgence of Monero-mining Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Digging Gold with a Spoon – Resurgence of Monero-mining Malware

Intelbras RX1500 Router v2.2.17 and before is vulnerable to Integer Overflow. The websReadEvent function incorrectly uses the int type when processing the "command" field of the http header, causing the array to cross the boundary and overwrite other fields in the array.

CVE-2025-50404 is a medium severity integer overflow vulnerability affecting Intelbras RX1500 Router firmware version 2.2.17 and earlier. The vulnerability arises in the websReadEvent function, which processes the "command" field within the HTTP header. Specifically, the function incorrectly uses a signed integer type (int) to handle the length or value of the "command" field. This improper handling can cause an integer overflow, leading to an array index crossing its boundary and overwriting adjacent memory fields within the array. Such a memory corruption flaw can potentially be leveraged by an attacker to manipulate internal router data structures, causing integrity issues. According to the CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the vulnerability can be exploited remotely over the network without any privileges or user interaction, but it only impacts the integrity of the device, not confidentiality or availability. No known exploits are currently reported in the wild, and no patches have been published yet. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound), a common software weakness that can lead to unpredictable behavior or security breaches if exploited. Given the nature of the flaw, an attacker could potentially send specially crafted HTTP requests to the router's management interface to trigger the overflow and corrupt internal data, possibly affecting routing behavior or configuration integrity.

Detailed information about CVE-2025-50404: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-50404: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-50404: n/a

A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/confirm_reserve.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-6450 is a critical SQL Injection vulnerability identified in version 1.0 of the Simple Online Hotel Reservation System developed by code-projects. The vulnerability exists in the /admin/confirm_reserve.php file, specifically through improper sanitization of the 'transaction_id' parameter. An attacker can remotely exploit this flaw without requiring any authentication or user interaction, by manipulating the 'transaction_id' argument in HTTP requests. This allows the attacker to inject malicious SQL queries directly into the backend database. The consequence of successful exploitation includes unauthorized data access, modification, or deletion, potentially compromising the confidentiality, integrity, and availability of the reservation system's data. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low attack complexity, no privileges or user interaction required, but limited impact on confidentiality, integrity, and availability (each rated low). Although no known exploits are currently observed in the wild, the public disclosure of the vulnerability increases the risk of exploitation. The vulnerability affects only version 1.0 of the product, and no official patches or mitigations have been published yet. The Simple Online Hotel Reservation System is typically used by small to medium-sized hospitality businesses to manage bookings and transactions, making the database a valuable target for attackers seeking customer data or to disrupt operations.

Detailed information about CVE-2025-6450: SQL Injection in code-projects Simple Online Hotel Reservation System affecting code-projects Simple Online Hotel Rese

CVE-2025-6450: SQL Injection in code-projects Simple Online Hotel Reservation System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-6450: SQL Injection in code-projects Simple Online Hotel Reservation System

A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/checkout_query.php. The manipulation of the argument transaction_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-6449 is a critical SQL Injection vulnerability identified in version 1.0 of the Simple Online Hotel Reservation System developed by code-projects. The vulnerability exists in the /admin/checkout_query.php file, specifically through the manipulation of the 'transaction_id' parameter. An attacker can remotely exploit this flaw without requiring any authentication or user interaction. By injecting malicious SQL code into the 'transaction_id' parameter, the attacker can manipulate backend database queries, potentially leading to unauthorized data access, data modification, or deletion. The vulnerability is classified with a CVSS 4.0 base score of 6.9, indicating a medium severity level, primarily due to limited impact on confidentiality, integrity, and availability (all rated low), but with ease of exploitation (no privileges or user interaction needed) and remote network attack vector. Although no public exploits are currently known in the wild, the exploit details have been disclosed publicly, increasing the risk of exploitation. The affected product is a web-based hotel reservation system, which is likely used by small to medium hospitality businesses to manage bookings and transactions. The lack of available patches or vendor advisories at this time increases the urgency for organizations to implement mitigations.

Detailed information about CVE-2025-6449: SQL Injection in code-projects Simple Online Hotel Reservation System affecting code-projects Simple Online Hotel Rese

Title	Severity	Type	Source	Date

Threats Affecting Greece

Filter Threats

Threats Affecting Greece

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility