A vulnerability has been found in code-projects Online Music Site 1.0. This affects an unknown function of the file /Frontend/AlbumByCategory.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A flaw has been found in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Frontend/ViewSongs.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profile.php of the component Student Registration Page. The manipulation of the argument photo results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used.
A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument L_email leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/Delete_product.php. Executing a manipulation of the argument del_pro can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. Performing a manipulation of the argument dre_title results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
A vulnerability has been found in code-projects Online Guitar Store 1.0. This impacts an unknown function of the file /admin/Create_category.php. Such manipulation of the argument dre_Ctitle leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kalender.Digital Calendar.Online / Kalender.Digital allows DOM-Based XSS.This issue affects Calendar.Online / Kalender.Digital: from n/a through 1.0.11.
Disney has agreed to pay $10 million to settle a lawsuit alleging violations of children's data privacy on YouTube. The case centers on claims that Disney improperly collected and used personal data from children without adequate consent or safeguards, violating privacy regulations. While this is a significant legal and financial consequence for Disney, it does not represent a direct technical vulnerability or exploit. The settlement highlights the increasing regulatory scrutiny on companies handling children's data, especially in digital and online platforms. European organizations should note the importance of compliance with data protection laws such as GDPR and the ePrivacy Directive, which impose strict requirements on processing children's personal data. This case underscores the risks of non-compliance, including costly legal actions and reputational damage. No active exploits or technical attack vectors are associated with this event. Organizations should review their data collection practices, especially for minors, and ensure transparency, parental consent, and data minimization. Countries with strong data protection enforcement and significant digital media markets, such as Germany, France, and the UK, are particularly relevant in this context. Overall, this incident is a legal and compliance issue rather than a cybersecurity threat or vulnerability requiring technical mitigation.
The Cl0p ransomware group has leaked 450GB of stolen data containing records of 30,000 Korean Air employees. This data breach exposes sensitive personal and possibly professional information, posing risks of identity theft, phishing, and reputational damage. Although no CVSS score is assigned, the breach is assessed as medium severity due to the volume and sensitivity of data exposed. European organizations, especially those in the aviation sector or with business ties to Korean Air, may face indirect impacts such as targeted phishing or supply chain risks. Mitigation should focus on monitoring for phishing attempts, enhancing employee awareness, and reviewing third-party risk management. Countries with significant aviation industries and strong economic ties to South Korea, such as Germany, France, and the UK, are more likely to be affected. The threat does not involve active exploitation of vulnerabilities but results from a prior compromise and data exfiltration by a known ransomware group. Defenders should prioritize detection of related phishing campaigns and strengthen incident response capabilities.
This report discusses a novel social engineering threat where attackers use AI-generated images to fraudulently obtain refunds from companies. The technique involves creating realistic but fake images that purportedly show product defects or issues, convincing customer service to issue refunds or replacements. While not a direct technical vulnerability, this tactic exploits human trust and procedural weaknesses in customer support processes. The threat does not involve malware or system compromise but can lead to financial losses and operational disruption. European organizations with significant e-commerce or customer service operations are at risk, especially those lacking robust verification procedures. Mitigation requires enhanced customer interaction protocols, AI detection tools, and staff training to identify suspicious claims. Countries with large retail sectors and high online shopping adoption, such as Germany, the UK, and France, are most likely affected. The severity is assessed as medium due to the indirect nature of the threat, limited technical impact, but potential financial and reputational damage. Defenders should focus on process hardening and awareness to reduce exploitation risk.
A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/search-invoices.php. Executing a manipulation of the argument searchdata can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /detailtransac.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown function of the file /updatesupplier.php?action=edit. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. The impacted element is an unknown function of the file /updatecustomer.php?action=edit. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Telenium Online Web Application is vulnerable due to a Perl script that
is called to load the login page. Due to improper input validation, an
attacker can inject arbitrary Perl code through a crafted HTTP request,
leading to remote code execution on the server.
CVE-2025-15049 is a medium-severity SQL injection vulnerability found in version 1.0 of the code-projects Online Farm System, specifically in the /addProduct.php file. The flaw arises from improper sanitization of the 'Username' parameter, allowing remote attackers to inject malicious SQL code without authentication or user interaction. Exploitation could lead to partial compromise of confidentiality, integrity, and availability of the backend database. Although no known exploits are currently active in the wild, a public exploit exists, increasing the risk of future attacks. This vulnerability primarily affects organizations using this specific online farm management software. European agricultural businesses and related service providers using this system are at risk, especially in countries with higher adoption of such platforms. Mitigation requires immediate input validation, parameterized queries, and monitoring for suspicious database activity. Given the medium CVSS score of 6.
