A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Executing manipulation of the argument cid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-complaint.php. Performing manipulation of the argument cid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
DraftKings recently detected and successfully thwarted a credential stuffing attack targeting its user accounts. Although the attack was blocked, the company has urged all users to reset their passwords and enable multi-factor authentication (MFA) to enhance account security. Credential stuffing involves attackers using large volumes of stolen username-password pairs from other breaches to gain unauthorized access. This type of attack exploits password reuse and weak authentication practices. While no known exploits are currently active in the wild, the incident highlights the ongoing risk posed by credential stuffing campaigns. European organizations with similar user-facing platforms should be vigilant against such attacks, especially given the widespread use of reused credentials. Implementing strong authentication controls and monitoring for unusual login patterns are critical. Countries with high online betting and gaming activity, such as the UK and Germany, may be more exposed. The threat is assessed as medium severity due to the potential for account compromise but mitigated by the lack of active exploitation and the availability of effective countermeasures.
Hackers are exploiting vulnerabilities in WordPress sites, specifically targeting themes or plugins, to facilitate advanced ClickFix phishing attacks. These attacks leverage compromised WordPress sites as infrastructure to host or redirect victims to phishing pages, increasing the credibility and reach of the campaigns. Although no specific affected versions or patches are currently identified, the threat is considered high severity due to the potential scale and impact. No known exploits are reported in the wild yet, but the threat is emerging and requires immediate attention. European organizations using WordPress for their websites are at risk, especially those with high web presence or e-commerce platforms. Attackers benefit from the widespread use of WordPress and the trust users place in legitimate websites, making phishing campaigns more effective. Mitigation involves securing WordPress installations, auditing themes and plugins, and monitoring for unauthorized changes or suspicious traffic. Countries with large WordPress user bases and significant online business sectors, such as Germany, the UK, France, and the Netherlands, are more likely to be targeted. The threat severity is assessed as high due to the ease of exploitation, potential for widespread impact, and significant confidentiality and integrity risks without requiring user interaction beyond clicking a link.
The Shuyal stealer is a newly identified malware targeting 17 different web browsers to extract sensitive login credentials and Discord tokens. It aims to compromise user accounts by stealing authentication data stored in browsers, enabling attackers to access victims' online services and Discord communications. Although no known exploits in the wild have been reported yet, the malware's capability to harvest a wide range of browser data poses a significant privacy and security risk. The threat is rated medium severity due to its potential impact on confidentiality and the ease of exploitation once the malware is executed. European organizations using popular browsers and Discord for communication could face data breaches and account takeovers. Mitigation requires targeted measures such as disabling unnecessary credential storage, monitoring for unusual Discord activity, and employing endpoint detection solutions tuned for credential theft. Countries with high adoption of affected browsers and extensive use of Discord, such as Germany, France, and the UK, are more likely to be impacted. Given the malware's focus on credential theft without requiring complex exploitation or user interaction beyond initial infection, the suggested severity is medium. Defenders should prioritize detection and prevention of initial infection vectors and secure browser-stored credentials to reduce risk.
A vulnerability has been found in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /admin/login.php. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This vulnerability affects unknown code of the file /admin/voters_add.php. Executing manipulation of the argument photo can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
A flaw has been found in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/voters_add.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. Other parameters might be affected as well.
DraftKings has reported account breaches resulting from credential stuffing attacks, where attackers use large volumes of stolen username-password pairs to gain unauthorized access. These attacks exploit reused credentials from previous data breaches, allowing attackers to compromise user accounts without needing to exploit software vulnerabilities. The threat is significant due to the potential exposure of personal and financial information stored in DraftKings accounts. European users of DraftKings are at risk, especially in countries with high online betting activity. The attacks do not require sophisticated exploits but rely on the availability of leaked credentials and automated login attempts. Organizations should implement multi-factor authentication and monitor for unusual login patterns to mitigate these risks. The threat is assessed as high severity due to the potential impact on confidentiality and integrity of user data and the ease of exploitation. Countries with large online gambling markets and high DraftKings user bases, such as the UK and Germany, are likely to be most affected. Defenders should prioritize credential hygiene, user education, and enhanced authentication controls to reduce exposure.
A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /index.php. Performing manipulation of the argument voter results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Performing manipulation of the argument image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0. This affects an unknown function of the file /admin/addexec.php. Such manipulation of the argument image leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec.php. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. The affected element is an unknown function of the file /bwdates-reports-details.php. The manipulation of the argument fromdate/todate results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /search-visitor.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
A vulnerability was determined in Campcodes Online Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the file /admin/edit-course.php. Executing manipulation of the argument coursecode can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. Affected is an unknown function of the file /visitor-detail.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
