Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Yonyou-KSOA

A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-15421 is a remote SQL injection vulnerability affecting Yonyou KSOA version 9.0, located in the HTTP GET parameter handler of the /worksheet/agent_worksadd.jsp component. The vulnerability arises from improper sanitization of the 'ID' parameter, allowing attackers to inject malicious SQL queries directly into the backend database. This flaw enables unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data disclosure, data modification, or denial of service. The vulnerability does not require user interaction or privileges, making exploitation straightforward once the attacker can send crafted HTTP GET requests. The vendor has not issued a patch or response despite early notification, and exploit code is publicly available, increasing the risk of exploitation. The CVSS 4.0 score of 6.9 reflects medium severity, with low individual impacts on confidentiality, integrity, and availability but combined can result in significant compromise. The lack of vendor response and patch availability necessitates immediate defensive measures by affected organizations. Yonyou KSOA is widely used in enterprise resource planning and office automation systems, particularly in China and other Asian markets, making organizations in these regions more vulnerable. The vulnerability's exploitation could lead to data breaches, operational disruption, and reputational damage.

Detailed information about CVE-2025-15421: SQL Injection in Yonyou KSOA affecting Yonyou KSOA. Get real-time updates, technical details, and mitigation strategi

CVE-2025-15421: SQL Injection in Yonyou KSOA - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-15421: SQL Injection in Yonyou KSOA

A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-15420 is a SQL injection vulnerability identified in Yonyou KSOA version 9.0, a widely used enterprise resource planning (ERP) and office automation software suite. The vulnerability exists in the /worksheet/agent_work_report.jsp file, where the ID parameter is improperly sanitized, allowing attackers to inject malicious SQL commands. This injection flaw can be exploited remotely without authentication or user interaction, enabling attackers to manipulate backend database queries. Potential consequences include unauthorized data access, data modification, or deletion, and possibly further compromise of the underlying system. The vulnerability has been publicly disclosed, and exploit code is available, although no known widespread exploitation has been reported to date. The vendor has not responded to notifications, and no official patches have been released, leaving affected systems exposed. The CVSS 4.0 base score is 6.9, reflecting a medium severity level due to the ease of exploitation and potential impact on confidentiality, integrity, and availability. The vulnerability affects only version 9.0 of Yonyou KSOA, and no other versions have been reported as vulnerable. Given the critical role of ERP systems in business operations, exploitation could disrupt workflows and compromise sensitive corporate data.

Detailed information about CVE-2025-15420: SQL Injection in Yonyou KSOA affecting Yonyou KSOA. Get real-time updates, technical details, and mitigation strategi

CVE-2025-15420: SQL Injection in Yonyou KSOA - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-15420: SQL Injection in Yonyou KSOA


CVE-2025-15421: SQL Injection in Yonyou KSOACVE-2025-15421 0 A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. MediumVulnerabilityChinaSingaporeMalaysia+5#cve #cve-2025-15421 Join the discussion	CVE Database V5	01/02/2026, 01:02:05 UTC Added: 01/02/2026, 01:13:47 UTC
CVE-2025-15420: SQL Injection in Yonyou KSOACVE-2025-15420 0 A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. MediumVulnerabilityChinaUnited StatesJapan+6#cve #cve-2025-15420 Join the discussion	CVE Database V5	01/02/2026, 00:32:08 UTC Added: 01/02/2026, 00:43:47 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional