Slims (Senayan Library Management Systems) version 9.8.0 contains a cross-site request forgery (CSRF) vulnerability in the loan history maintenance functionality. The vulnerability arises because the action=run GET parameter triggers privileged, destructive operations without requiring a CSRF token or POST confirmation. This flaw allows an attacker to cause data loss of loan history records via unauthorized requests.
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-18. It is categorized as open-source intelligence (OSINT) focused on network activity and payload delivery. No specific malware details, affected software versions, or technical exploit information are provided.
YuanKong RAT is a multi-tenant Android remote access trojan that embeds operator identifiers in each build and uses a two-key XOR scheme to unpack payloads. It steals credentials via screen capture, accessibility abuse, and overlay attacks, and escalates privileges by pairing with the device's ADB daemon. Communication occurs over WebSocket with shared command-and-control domains. Analysis of samples revealed multiple distinct operator accounts and payloads.
QuartzLine, also known as CLOUDHAZE, is malware disguised as a legitimate Windows PDF viewer that contains a backdoor. It has been distributed via malicious advertising campaigns, leveraging AWS S3 buckets for hosting. The malware establishes persistence through scheduled tasks and communicates with command-and-control servers. It operates with user-level privileges, allowing attackers to execute arbitrary Windows commands and deploy additional malware such as the Caira and IronBark remote access trojans. Early activity includes theft of Chrome browser data within one week of infection. The malware is signed with a now-revoked legitimate EV code-signing certificate, appearing as paperline.exe and fielddesk.exe.
Suo5 is an HTTP/HTTPS-based tunneling tool exploited for pivoting attacks via compromised web servers to access internal networks. It supports multiple environments including Java, PHP, IIS/.NET, and Nginx, and relays TCP traffic enabling SOCKS5 proxy access. Deployment methods include file upload exploitation on IIS servers using renamed ASPX files and memory injection via Jenkins Script Console with Groovy scripts. Indicators of compromise include repeated POST requests in web logs, DLL files in Temporary ASP.NET Files directories, and PluginServletFilter chains in Java logs. Detection involves monitoring web request patterns, server-side behaviors, abnormal User-Agent headers, unauthorized URI access, and file modifications. Mitigations include restricting script execution capabilities and implementing network segmentation controls.
The Hotejka affiliate program, a rebrand of ROI777, operates the Help Traffic Distribution System (TDS) to deliver tech support scams. It uses browser fingerprinting and geolocation to redirect victims through compromised websites and malvertising to fake Microsoft security alerts that lock browsers and display fraudulent phone numbers. Victims who call are guided to install remote desktop tools like UltraViewer, granting attackers ongoing system access. Since April 2026, Hotejka has abused Cloudflare Pages to create over 20,000 disposable domains, generating about 300 new domains daily. Affiliates such as Balada Injector, Detour Dog, and DollyWay drive traffic to this TDS. Infoblox developed predictive detection algorithms that identify malicious domains about seven days before deployment, significantly reducing exposure.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple OpenSSH packages. This update addresses several vulnerabilities identified by multiple CVEs. The advisory provides updated RPM versions for various architectures. No explicit patch versions or affected versions are detailed in the advisory. The severity is assessed as medium.
A critical vulnerability exists in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router version 1.3.241114.024540 and earlier. This flaw allows a remote attacker to execute arbitrary code by accessing the www\cgi-bin\upgrade file. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.
GitPython versions up to 3.1.52 contain a configuration injection vulnerability where attacker-controlled submodule names can inject arbitrary config directives into the parent repository's .git/config file. This occurs because section names are insufficiently sanitized, allowing injection of directives like core.sshCommand that can lead to remote code execution on the victim's next git operation. The vulnerability is fixed in versions after 3.1.52.
CVE-2025-41451 is a command injection vulnerability in Danfoss AK-SM8xxA Series devices prior to version 4.3.1. It arises from improper neutralization of alarm-to-mail configuration fields used in OS shell commands. This flaw could allow an attacker with authenticated access to execute arbitrary code remotely on the affected system. The vulnerability requires high privileges and user interaction, and the attack complexity is high. No official patch or remediation details are provided in the available data.
