A user on Reddit's r/Malware subreddit reported discovering a new malware sample linked to a FiveM low PC graphics pack download. The user uploaded the suspected file to VirusTotal, where it received a detection score of 10 out of 65 antivirus engines. The user performed additional offline and online scans with Windows Defender and observed no immediate signs of compromise. The report is based on a single VirusTotal submission and minimal discussion, with no confirmed exploits or widespread impact noted.
A vulnerability was detected in itsourcecode Online House Rental System 1.0. This impacts an unknown function of the file /manage_payment.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
A security vulnerability has been detected in itsourcecode Online House Rental System 1.0. This affects an unknown function of the file /manage_tenant.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in itsourcecode Online House Rental System 1.0. The impacted element is an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in itsourcecode Online Blood Bank Management System 1.0. The affected element is an unknown function of the file /admin/campsdetails.php. Performing a manipulation of the argument hospital results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in itsourcecode Online Blood Bank Management System 1.0. Impacted is an unknown function of the file /admin/viewrequest.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
A vulnerability has been found in code-projects Online Hospital Management System 1.0. Affected is an unknown function of the file appointmentdetail.php of the component Appointment Handler. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
A flaw has been found in code-projects Online Hospital Management System 1.php. This impacts the function login_user of the file login_1.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
CVE-2026-10186 is a medium severity SQL injection vulnerability in code-projects Online Hospital Management System version 1.0. The vulnerability exists in the /patient.php file where manipulation of the 'editid' parameter allows remote attackers to perform SQL injection. This vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available from the vendor. Exploitation could lead to unauthorized database access or modification.
CVE-2026-10178 is a SQL injection vulnerability in code-projects Online Music Site version 1.0. It affects the /Administrator/PHP/AdminEditAlbum.php file, where manipulation of the ID parameter allows injection of SQL commands. The vulnerability can be exploited remotely without authentication. The exploit code is publicly available. No official patch or remediation guidance has been provided yet.
CVE-2026-10171 is a SQL injection vulnerability in code-projects Online Music Site version 1.0. It affects an unspecified part of the /Administrator/PHP/AdminUpdateAlbum.php file, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. The exploit details have been publicly disclosed. No official patch or remediation guidance is currently available.
A new phishing campaign targets Japanese online banking users by impersonating a legitimate bank with a typographical error in the brand name, using 'PayPoy' instead of the correct name. The phishing emails demand verification within 24 hours but contain a conspicuous branding typo that has reduced the campaign's perceived credibility, turning it into a viral meme in the local tech community rather than causing widespread alarm. The campaign was reported on Reddit cybersecurity forums with minimal discussion and no confirmed exploits in the wild. No patch or official remediation is applicable as this is a phishing campaign rather than a software vulnerability.
Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Retrieve Embedded Sensitive Data.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.
Authentication Bypass Using an Alternate Path or Channel vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Authentication Bypass.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.
A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The manipulation of the argument productName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f5690c0264c0d5ebde1623336e358b4eb60fa2e9fa2f9d26e5ef81d93a40678c)
ionic-insta-api-wrapper@1.2.2 is presented as a generic Instagram API client but silently routes caller-supplied Instagram credentials and sessions to a hardcoded author-controlled backend at reelsaver.appit-online.de, and uses the resulting authenticated session to perform remotely-chosen follow/like actions on the caller's Instagram account.
Specific behaviors in the shipped code:
- getCookie()/getCookies posts the caller-supplied Instagram username and password together with the full Instagram login response (session cookies, user id) to https://reelsaver.appit-online.de/v2/insta/check in addition to Instagram itself, moving the credentials and session outside Instagram's trust boundary without disclosure.
- LoginService.loginViaBackend sends the Instagram username, password, and 2FA code to https://reelsaver.appit-online.de/v2/insta/login as a fallback login path, so the author's server performs the login and retains the credentials and resulting session.
- After login, verifyAccount fetches a user/post list from https://reelsaver.appit-online.de/v2/insta/verify and uses the installer's authenticated Instagram session to call friendships/create and media/like on each returned target, giving the author runtime control over actions performed from the installer's account.
- fetchAPI issues an analytics GET to {analyticsBaseUrl}/v2/insta/{username}/{target}/{type} on every library call, leaking the installer's Instagram identity and the identifiers of profiles/stories/posts being queried to the same author host.
The destination host is hardcoded, not configurable to Instagram directly, and the credential relay, server-directed account actions, and per-call activity logging are not described in the library's advertised purpose. Installing applications therefore disclose end-user Instagram credentials, sessions, and account activity to the package author, and the author can direct follows and likes from any authenticated session.
## Source: ghsa-malware (0afdd20d94c501c22b6c129762fd5e2225ae4a9e341091301b08ffae30459b44)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0.
ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval() call inside tagsets/participant.php and tagsets/options.php.
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in all versions up to, and including, 4.3.5. This is due to improper handling of user-supplied request parameters in the REST API endpoint, which passes the unsanitized parameter array to the add_to_cart() function where array_merge() allows attacker-controlled values to overwrite hardcoded defaults. This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in any paid course entirely free of charge by supplying a quantity value of zero, which causes the order total to calculate as $0 and bypasses all payment gateway requirements.
