Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

JPACookieShop

A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsController.java. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely.

CVE-2025-7939 is a vulnerability identified in version 1.0 of the JPACookieShop 蛋糕商城JPA版, an e-commerce platform developed by jerryshensjf. The vulnerability resides in the addGoods function within the GoodsController.java file. This flaw allows an attacker to perform an unrestricted file upload remotely without requiring user interaction or authentication. Unrestricted file upload vulnerabilities typically enable attackers to upload malicious files, such as web shells or scripts, which can then be executed on the server. This can lead to full system compromise, data theft, or service disruption. The CVSS 4.0 base score is 5.3, indicating a medium severity level, with attack vector being network-based, low attack complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. However, the vulnerability's unrestricted upload nature means that if exploited, the attacker could escalate impact beyond the initial scope, depending on the server configuration and uploaded payload. No known exploits are currently reported in the wild, and no patches or mitigations have been officially published yet. The vulnerability affects only version 1.0 of the product, which suggests that newer versions may have addressed this issue or that the product is relatively new or niche. The lack of CWE classification limits detailed understanding of the exact coding flaw, but unrestricted upload vulnerabilities often stem from insufficient validation of file types, sizes, or paths in upload handlers.

Detailed information about CVE-2025-7939: Unrestricted Upload in jerryshensjf JPACookieShop 蛋糕商城JPA版 affecting jerryshensjf JPACookieShop 蛋糕商城JPA版. Get real-tim

CVE-2025-7939: Unrestricted Upload in jerryshensjf JPACookieShop 蛋糕商城JPA版 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7939: Unrestricted Upload in jerryshensjf JPACookieShop 蛋糕商城JPA版

A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsController.java. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7938 is a critical authorization bypass vulnerability identified in version 1.0 of the jerryshensjf JPACookieShop 蛋糕商城JPA版 application, specifically within the updateGoods function of the GoodsController.java file. This vulnerability allows an attacker to remotely manipulate the updateGoods function to bypass authorization controls, potentially enabling unauthorized modification of goods data. The vulnerability does not require user interaction and can be exploited remotely with low attack complexity, although it requires some level of privileges (PR:L) indicating that the attacker must have limited privileges but no user interaction is needed. The CVSS 4.0 vector indicates no confidentiality, integrity, or availability impact (VC:N, VI:L, VA:N), suggesting that the primary impact is limited to integrity with low scope. Despite the CVSS score of 5.3 (medium severity), the vulnerability is critical in nature because it allows unauthorized access to update goods information, which could lead to data tampering or business logic manipulation. No patches or fixes have been linked yet, and no known exploits are currently observed in the wild, though public disclosure increases the risk of exploitation. The vulnerability affects only version 1.0 of the product, which is a niche e-commerce application likely used in specific markets. The lack of authentication bypass (AT:N) and no user interaction (UI:N) means exploitation is straightforward once limited privileges are obtained, emphasizing the need for strict access controls and monitoring.

Detailed information about CVE-2025-7938: Authorization Bypass in jerryshensjf JPACookieShop 蛋糕商城JPA版 affecting jerryshensjf JPACookieShop 蛋糕商城JPA版. Get real-ti

CVE-2025-7938: Authorization Bypass in jerryshensjf JPACookieShop 蛋糕商城JPA版 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7938: Authorization Bypass in jerryshensjf JPACookieShop 蛋糕商城JPA版


CVE-2025-7939: Unrestricted Upload in jerryshensjf JPACookieShop 蛋糕商城JPA版CVE-2025-7939 0 A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsController.java. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve #cve-2025-7939 Join the discussion	CVE Database V5	07/21/2025, 20:32:05 UTC Added: 07/21/2025, 20:46:06 UTC
CVE-2025-7938: Authorization Bypass in jerryshensjf JPACookieShop 蛋糕商城JPA版CVE-2025-7938 0 A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsController.java. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. MediumVulnerabilityGermanyFranceUnited Kingdom+2#cve #cve-2025-7938 Join the discussion	CVE Database V5	07/21/2025, 20:02:05 UTC Added: 07/21/2025, 20:16:10 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional