A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.
A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely.
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.
A Chinese-speaking cybercrime group known as Gambling Goblin has targeted Brazilian government and educational websites since mid-2025 by compromising web servers and installing malicious Apache modules. These modules reverse-proxy visitors to phishing pages impersonating trusted app stores but actually promote online gambling and sports betting. The attackers manipulate search engine rankings by chaining compromised high-reputation domains, mainly Brazilian government sites. The operation uses a heavily obfuscated Linux toolkit with custom downloaders, backdoors, credential stealers, and reconnaissance tools. The campaign also targets victims in Vietnam, Spain, and English-speaking regions.
Since mid-2025, a Chinese-speaking cybercrime group dubbed Gambling Goblin has conducted a sustained campaign targeting Brazilian organizations, mainly government and educational institutions. The attackers compromise web servers and install malicious Apache modules that stealthily reverse-proxy visitors to phishing pages impersonating trusted app stores. These phishing pages promote online gambling and sports betting while leveraging hijacked high-reputation domains to manipulate search engine rankings and hijack traffic. The group uses a heavily obfuscated Linux toolkit including downloaders, backdoors, credential stealers, and brute-forcers. The infrastructure is scalable and extends beyond Brazil, with parallel phishing networks targeting Vietnamese, Spanish, and English-speaking victims. The phishing infrastructure could be reconfigured to deliver malware directly, posing a latent escalation risk.
A high-severity authentication bypass vulnerability affects nearly 22,000 Microsoft Exchange servers exposed online. This flaw allows attackers to hijack all user mailboxes on vulnerable servers. The vulnerability remains unpatched on these servers, increasing the risk of unauthorized access. No specific affected versions or patch information is provided in the available data. There is no indication of known exploits in the wild at this time.
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
A widespread outage affecting Microsoft Exchange Online and multiple Microsoft 365 services caused authentication failures, email delays, and service disruptions. The root cause was identified as core authentication configuration issues within Exchange Online infrastructure. Microsoft mitigated the outage after approximately three days, restoring all affected services and resolving user impact scenarios. The outage impacted email sending/receiving, mailbox searches, authentication, and mailbox operations. Other Microsoft 365 services such as Teams, OneDrive for Business, SharePoint Online, and Microsoft Defender XDR were also affected during the incident.
This update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen fixes the following issues:
Changes in MozillaFirefox:
Firefox Extended Support Release 153.1.0 ESR.
* Fixed: Various security fixes.
MFSA 2026-77 (bsc#1274867):
* CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
* CVE-2026-74935 Privilege escalation in the DOM: Networking component
* CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-74937 Use-after-free in the JavaScript: GC component
* CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
* CVE-2026-74939 Privilege escalation in the DOM: Navigation component
* CVE-2026-74940 Use-after-free in the Graphics: Text component
* CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component
* CVE-2026-74942 Privilege escalation in the Remote Settings Client component
* CVE-2026-74943 Use-after-free in the Graphics: ImageLib component
* CVE-2026-74944 Use-after-free in the DOM: Core & HTML component
* CVE-2026-74945 Information disclosure in the Graphics: Text component
* CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component
* CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics
component
* CVE-2026-74948 Information disclosure in the Graphics component
* CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics:
Canvas2D component
* CVE-2026-74950 Privilege escalation in the Downloads API component
* CVE-2026-74953 Privilege escalation in the Networking: Cookies component
* CVE-2026-74954 Information disclosure due to side-channel in the Storage:
Cache API component
* CVE-2026-74955 Privilege escalation in the Request Handling component
* CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers
component
* CVE-2026-74957 Mitigation bypass in the Safe Browsing component
* CVE-2026-74958 Information disclosure in the WebRTC component
* CVE-2026-74959 Mitigation bypass in the Storage: Cache API component
* CVE-2026-74960 Site isolation issue in the WebExtensions component
* CVE-2026-74961 Side-channel in the Web Audio component
* CVE-2026-74962 Site isolation issue in the Networking: Cookies component
* CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies
component
* CVE-2026-74964 Integer overflow in the Graphics component
* CVE-2026-74965 Privilege escalation in the Shell Integration component
* CVE-2026-74966 Information disclosure in the Form Autofill component
* CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback
component
* CVE-2026-74968 Site isolation issue in the Graphics: WebRender component
* CVE-2026-74969 Use-after-free in the Layout: Text and Fonts component
* CVE-2026-74970 Site isolation issue in the Graphics component
* CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling
component
* CVE-2026-74972 Information disclosure in the DOM: Push Subscriptions
component
* CVE-2026-74973 Race condition, use-after-free in the Graphics component
* CVE-2026-74974 Same-origin policy bypass in the Graphics: ImageLib component
* CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-74977 Integer overflow in the Graphics component
* CVE-2026-74978 Clickjacking issue in the Widget component
* CVE-2026-74979 Mitigation bypass in the Add-ons Manager component
* CVE-2026-74981 Site isolation issue in the Audio/Video: Web Codecs component
* CVE-2026-74982 Denial-of-service in the Widget component
* CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component
* CVE-2026-74984 Race condition in the JavaScript Engine component
* CVE-2026-74985 Privilege escalation in the Enterprise Policies component
* CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation
component
* CVE-2026-74987 Internally found bugs fixed in Firefox ESR 140.14, Firefox
ESR 153.1 and Firefox 154
* CVE-2026-74988 Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154
* CVE-2026-74990 Internally found bugs fixed in Firefox ESR 115.39, Firefox
ESR 140.14, Firefox ESR 153.1 and Firefox 154
Firefox Extended Support Release 153.0esr ESR
* New: ## General
- Firefox now includes a new profile management system that
helps you separate your online life into distinct profiles
for work, school, vacation planning, or whatever you choose.
Profiles can be customized with names, avatars, and color
themes while keeping tabs, bookmarks, passwords, and browsing
history separate. Built-in profile backup and restore also
makes it easier to migrate to a new device or recover your
browsing data.
- Split View lets you view two webpages side-by-side in a
single browser window, with additional options to quickly
open links in Split View, rearrange
A Magecart campaign uses EtherHiding techniques to perform card-skimming on e-commerce platforms. Attackers compromise legitimate online storefronts, mainly WooCommerce, but also PrestaShop, Magento, and WordPress sites, injecting malicious loaders disguised as Google Tag Manager code. The skimming payloads are staged inside Ethereum blockchain smart-contract storage, making detection more difficult. Over 40 websites across 15 countries have been impacted since April 2026. The infrastructure involves 144 Sepolia contracts controlled by a single wallet, with 20 distinct contracts and skimmer-hosting domains identified. The malicious code appears as normal analytics but steals credit card data from shoppers.
A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-82700 is a medium severity cross-site scripting (XSS) vulnerability found in version 1.0 of the code-projects Online Shopping System. The vulnerability exists in the /offersmail.php file within the Newsletter Subscription component, where manipulation of the email argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. Public exploit code is available. No official patch or remediation guidance has been provided yet.
