A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/admin_product.ph. Executing a manipulation of the argument pid can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/admin_feature.php. Performing a manipulation of the argument pid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_index.php. Such manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim’s credentials if the server accepts those cross-origin requests as authenticated. Laravel’s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel’s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0
A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_result.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in code-projects Online Event Judging System 1.0. This vulnerability affects unknown code of the file /edit_contestant.php. Executing manipulation of the argument contestant_id can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing manipulation of the argument fullname results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected by this issue is some unknown functionality of the file /add_judge.php. Such manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
A vulnerability was found in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /ajax/action.php. The manipulation of the argument content results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
A medium-severity security news report details a hacking incident involving the World Poker Tour's ClubWPT Gold back office. The information originates from a Reddit NetSec post linking to an external blog by a known author, but technical details are minimal and no specific vulnerabilities or exploits are disclosed. There is no evidence of known exploits in the wild or affected software versions. The threat appears to be a targeted compromise of a gaming platform's administrative backend, potentially risking data confidentiality and integrity. European organizations involved in online gaming or gambling platforms may face indirect risks if similar vulnerabilities exist. Mitigation should focus on securing back-office systems, enforcing strong access controls, and monitoring for unusual activity. Countries with significant online gambling markets and regulatory scrutiny, such as the UK, Germany, and Malta, are more likely to be affected. Given the limited technical details and lack of active exploitation, the suggested severity is medium. Defenders should prioritize investigation and enhanced monitoring while awaiting further technical disclosures.
The Russian agricultural regulatory agency Rosselkhoznadzor was targeted by a distributed denial-of-service (DDoS) attack, causing delays in food shipments across Russia. This attack disrupted the agency's online services, impacting its ability to process and manage food shipment logistics. Although no direct exploitation of software vulnerabilities was reported, the attack highlights the risk of service disruption to critical supply chain infrastructure. The attack's medium severity reflects its impact on availability rather than confidentiality or integrity. European organizations involved in agricultural trade or supply chains linked to Russia could face indirect effects such as delays or increased scrutiny. Mitigation should focus on enhancing DDoS resilience through traffic filtering, capacity scaling, and incident response planning. Countries with strong trade ties to Russia and significant agricultural sectors, such as Germany, Poland, and the Netherlands, are more likely to be affected. Given the attack's nature and impact, the suggested severity is medium due to the disruption of availability without evidence of data compromise or exploitation complexity.
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function
in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
The customer information published on the dark web includes names, addresses, phone numbers, and email addresses. The post Toys ‘R’ Us Canada Customer Information Leaked Online appeared first on SecurityWeek .
A critical vulnerability named "SessionReaper" in Adobe Magento is being actively exploited by hackers. This flaw affects Magento e-commerce platforms, potentially allowing attackers to hijack or manipulate user sessions. Although no specific affected versions or patches have been detailed, the exploit's critical severity indicates a high risk to confidentiality, integrity, and availability of Magento-based online stores. European organizations using Magento are at risk of data breaches, financial fraud, and service disruptions. Immediate mitigation steps include monitoring for unusual session activity, applying any forthcoming patches promptly, and implementing enhanced session management controls. Countries with significant e-commerce sectors and widespread Magento adoption, such as Germany, the UK, France, and the Netherlands, are most likely to be targeted. Given the critical nature, ease of exploitation, and potential impact, the suggested severity is critical. Defenders should prioritize detection and response measures to prevent exploitation and protect customer data and business operations.
Muji, a major retail company, has halted its online sales operations following a ransomware attack on one of its suppliers. The attack disrupted supply chain operations, impacting Muji's ability to conduct e-commerce activities. Although no direct details about the ransomware variant or exploited vulnerabilities are available, the incident highlights the risks posed by third-party supplier compromises. The attack did not have known exploits in the wild at the time of reporting, but the impact was significant enough to force operational changes. European organizations relying on complex supply chains and third-party vendors face similar risks. The attack underscores the importance of supply chain cybersecurity and incident response readiness. Mitigation should focus on enhancing supplier security assessments, network segmentation, and rapid detection capabilities. Countries with strong retail sectors and extensive supply chain dependencies, such as Germany, France, and the UK, are likely to be most affected. Given the high operational impact and potential data confidentiality risks, the severity is assessed as high. Defenders should prioritize supply chain risk management and ransomware resilience strategies.
