A flaw has been found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /cakeshop/product.php. Executing manipulation of the argument Product can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /cakeshop/supplier.php. Performing manipulation of the argument supplier results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
A security vulnerability has been detected in itsourcecode Online Pet Shop Management System 1.0. This issue affects some unknown processing of the file /pet1/update_cnp.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in itsourcecode Online Pet Shop Management System 1.0. This vulnerability affects unknown code of the file /pet1/addcnp.php. This manipulation of the argument cnpname causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
Offline Decryption Messaging is a proposed security model designed to protect communications even when online devices are compromised by spyware. It uses two devices per user: an online device for transmitting encrypted messages and an air-gapped offline device for writing, encrypting, decrypting, and displaying messages. This separation ensures that spyware on the online device cannot access plaintext messages or cryptographic keys, while spyware on the offline device cannot exfiltrate data due to lack of network connectivity. The concept aims to address the limitations of traditional end-to-end encrypted messengers like Signal, which become ineffective if the device itself is compromised. The project, called HelioSphere, is in early prototype stages and seeks community feedback on security, usability, and cryptographic improvements. While promising for high-risk users such as activists, the approach introduces operational complexity and usability challenges. No known exploits exist yet, and the threat is currently a conceptual proposal rather than an active attack vector. The suggested severity is medium due to the potential to mitigate spyware risks but also the practical challenges in deployment.
A vulnerability was identified in itsourcecode Online Pet Shop Management System 1.0. This affects an unknown part of the file /pet1/available.php. Such manipulation of the argument Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile. Performing a manipulation of the argument userphoto results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used.
A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The affected element is an unknown function of the file /admin/admin_running.php. This manipulation of the argument pid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Insikt Group has identified four distinct activity clusters associated with GrayBravo's CastleLoader malware, each with unique tactics and victim profiles. This supports the assessment that GrayBravo operates a malware-as-a-service model. One cluster, TAG-160, impersonates logistics firms and uses phishing lures with the ClickFix technique to distribute CastleLoader. Another cluster, TAG-161, impersonates Booking.com and employs similar techniques. The analysis also uncovered potential links to the online persona "Sparja" and the broader cybercriminal ecosystem. GrayBravo demonstrates rapid evolution, technical sophistication, and adaptability in response to public exposure. The report recommends various security measures to defend against these threats.
Cybercriminals are increasingly manipulating online photos to fabricate virtual kidnapping scenarios, demanding ransoms from victims or their families. This social engineering tactic leverages altered images to create believable threats without physical abduction. The FBI has highlighted this emerging trend, emphasizing the psychological pressure on victims. Although no direct software vulnerabilities are exploited, the threat exploits human trust and fear. European organizations and individuals may face increased targeting due to widespread social media use and digital photo sharing. The threat's medium severity reflects its significant impact on confidentiality and integrity of personal safety perceptions, despite lacking technical exploitation. Mitigation requires enhanced public awareness, verification protocols, and law enforcement collaboration. Countries with high social media penetration and affluent populations are more vulnerable. This threat underscores the evolving nature of cybercrime blending digital manipulation with psychological tactics.
A security vulnerability has been detected in code-projects Online Ordering System 1.0. This affects an unknown function of the file /admin/ of the component Admin Login. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in code-projects Online Ordering System 1.0. The impacted element is an unknown function of the file /user_contact.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /user_school.php. The manipulation of the argument product_id results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited.
In affected versions, vulnerability-lookup did not track or limit failed
One-Time Password (OTP) attempts during Two-Factor Authentication (2FA)
verification. An attacker who already knew or guessed a valid username
and password could submit an arbitrary number of OTP codes without
causing the account to be locked or generating any specific alert for
administrators.
This lack of rate-limiting and lockout on OTP failures significantly
lowers the cost of online brute-force attacks against 2FA codes and
increases the risk of successful account takeover, especially if OTP
entropy is reduced (e.g.short numeric codes, user reuse, or predictable
tokens). Additionally, administrators had no direct visibility into
accounts experiencing repeated 2FA failures, making targeted attacks
harder to detect and investigate.
The patch introduces a persistent failed_otp_attempts counter on user
accounts, locks the user after 5 invalid OTP submissions, resets the
counter on successful verification, and surfaces failed 2FA attempts in
the admin user list. This enforces an account lockout policy for OTP
brute-force attempts and improves monitoring capabilities for suspicious
2FA activity.This issue affects Vulnerability-Lookup: before 2.18.0.
A vulnerability was detected in SourceCodester Online Banking System 1.0. This impacts an unknown function of the file /?page=user. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.
A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_running.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-14206 is an improper authorization vulnerability in SourceCodester Online Student Clearance System version 1.0, specifically in the /Admin/delete-fee.php component. By manipulating the ID parameter remotely, an attacker can bypass authorization controls to delete fee records without proper permissions. This vulnerability requires no authentication or user interaction and has a CVSS 4.0 base score of 6.9 (medium severity). Although no known exploits are currently in the wild, the exploit details have been publicly disclosed, increasing the risk of exploitation. The vulnerability impacts confidentiality and integrity by allowing unauthorized deletion of financial data related to student fees. European educational institutions using this system or similar software are at risk, especially in countries with widespread adoption of SourceCodester products or where student financial systems are targeted.
A vulnerability was found in RashminDungrani online-banking up to 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. This affects an unknown part of the file /site/dist/auth_login.php. Performing manipulation of the argument Username results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
The Aisuru botnet recently launched the largest recorded DDoS attack, peaking at 29.7 Tbps, which was successfully mitigated by Cloudflare. This attack represents a significant escalation in volumetric DDoS capabilities, leveraging a large network of compromised devices to overwhelm targeted infrastructure. While no specific vulnerabilities or exploits were involved, the scale and sophistication of the botnet pose a serious threat to internet-facing services. European organizations, especially those with critical online infrastructure, could face service disruptions if targeted. Mitigation requires advanced DDoS protection services, network traffic filtering, and incident response preparedness. Countries with high internet infrastructure density and strategic digital assets, such as Germany, the UK, France, and the Netherlands, are likely to be primary targets. Given the attack's scale, ease of execution via botnet control, and potential for widespread disruption, the threat severity is assessed as high. Defenders should prioritize robust DDoS defenses and continuous monitoring to mitigate impact from similar future attacks.
