Tag: 2025-03-26

4 Attack Reports | 173 Vulnerabilities

Attack reports

Kentico Xperience Staging Service Authentication Bypass Vulnerabilities (CVE-2025-2746 & CVE-2025-2747)

Two critical security flaws, CVE-2025-2746 and CVE-2025-2747, have been discovered in Kentico Xperience 13, a digital experience platform. These vulnerabilities allow unauthenticated attackers to bypass the Staging Sync Server's authentication, potentially gaining administrative control over the CM…
remote code execution
authentication bypass
CVE-2025-2746
CVE-2025-2747
CVE-2025-2749
2025-03-26
kentico xperience
Published: March 26, 2025
Linked vulnerabilities : CVE-2025-2746 (CVSS 9.8), CVE-2025-2747 (CVSS 9.8), CVE-2025-2749 (CVSS 7.2)
Downloadable IOCs: 0

You will always remember this as the day you finally caught FamousSparrow

ESET researchers uncovered new activity by the FamousSparrow APT group, including two undocumented versions of their SparrowDoor backdoor. The group compromised a US financial sector trade group and a Mexican research institute in July 2024. The new SparrowDoor versions show significant improvement…
shadowpad
modular malware
sparrowdoor
2025-03-26
hemigate
Published: March 26, 2025
Downloadable IOCs: 12

Malware found on npm infecting local package with reverse shell

A sophisticated malware campaign targeting npm packages has been discovered, involving two malicious packages: ethers-provider2 and ethers-providerz. These packages act as downloaders, hiding their malicious payload cleverly. Upon installation, they patch the legitimate locally-installed npm packag…
persistence
javascript
npm
reverse-shell
2025-03-26
ethers-provider2
package-infection
ethers-providerz
Published: March 26, 2025
Downloadable IOCs: 1

Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

ReaderUpdate, a macOS malware loader platform active since 2020, has evolved to include variants written in Crystal, Nim, Rust, and now Go programming languages. Originally a compiled Python binary, the malware has been largely dormant until late 2024. The loader is capable of executing remote comm…
malware
loader
persistence
macos
adware
rust
go
2025-03-26
nim
genieo
crystal
silver toucan
dolittle
wizardupdate
updateagent
readerupdate
Published: March 26, 2025
Downloadable IOCs: 12
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-28893

9.9
    *
  • Visual Text Editor
Published: March 26, 2025

CVE-2024-47516

9.8
    Pagure
  • Pagure
Published: March 26, 2025

CVE-2025-28916

9.8
    Notfound
  • Docpro
Published: March 26, 2025

CVE-2025-2825

9.8
    Crushftp
  • Crushftp
Published: March 26, 2025

CVE-2025-25535

9.8
    Script Case
  • Script Case
Published: March 26, 2025

CVE-2025-26002

9.8
    Telesquare
  • Telesquare Tlr-2005ksh
Published: March 26, 2025

CVE-2025-26003

9.8
    Telesquare
  • Tler-2005ksh
Published: March 26, 2025

CVE-2025-26004

9.8
    Telesquare
  • Telesquare Tlr-2005ksh
Published: March 26, 2025

CVE-2024-55964

9.8
    Appsmith
  • Appsmith
    Postgresql
Published: March 26, 2025

CVE-2025-26005

9.8
    Telesquare
  • Tlr-2005ksh
Published: March 26, 2025

CVE-2025-26006

9.8
    Telesquare
  • Tlr-2005ksh
Published: March 26, 2025

CVE-2025-26007

9.8
    Telesquare
  • Telesquare Tlr-2005ksh
Published: March 26, 2025

CVE-2025-26008

9.8
    Telesquare
  • Tler-2005ksh
Published: March 26, 2025

CVE-2025-26010

9.8
    Telesquare
  • Telesquare Tlr-2005ksh
Published: March 26, 2025

CVE-2025-26011

9.8
    Telesquare
  • Tlr-2005ksh
Published: March 26, 2025

CVE-2025-1542

9.3
    Oxari
  • Servicedesk
Published: March 26, 2025

CVE-2025-26941

9.3
    Andy Moyle
  • Church Admin
Published: March 26, 2025

CVE-2025-28898

9.3
    Notfound
  • Wp Multistore Locator
Published: March 26, 2025

CVE-2025-28942

9.3
    Trust Payments
  • Trust Payments Gateway For Woocommerce
Published: March 26, 2025

CVE-2025-30524

9.3
    Origincode
  • Product Catalog
Published: March 26, 2025

CVE-2024-13146

8.8
    Booknetic
  • Booknetic
Published: March 26, 2025

CVE-2025-2110

8.8
    Wordpress
  • Wp Compress
Published: March 26, 2025

CVE-2025-2837

8.8
    Silicon Labs
  • Gecko Os
Published: March 26, 2025

CVE-2025-2787

8.7
    Knime
  • Business Hub
Published: March 26, 2025

CVE-2025-30353

8.6
    Directus
  • Directus
Published: March 26, 2025

CVE-2025-28873

8.5
    Notfound
  • Shuffle
Published: March 26, 2025

CVE-2025-28939

8.5
    Notfound
  • Wp Google Calendar Manager
Published: March 26, 2025

CVE-2025-2098

8.4
    Fast Cad Reader
  • Fast Cad Reader
Published: March 26, 2025

CVE-2025-2783

8.3
    Google
  • Chrome
    Microsoft
Published: March 26, 2025

CVE-2024-13801

8.1
    Wordpress
  • Plugin
Published: March 26, 2025

CVE-2025-23937

8.1
    Notfound
  • Notfound Linkedin Lite
Published: March 26, 2025

CVE-2025-23952

8.1
    Ntm
  • Custom-Field-List-Widget
Published: March 26, 2025

CVE-2025-24690

8.1
    Michele Giorgi
  • Formality
Published: March 26, 2025

CVE-2025-26986

8.1
    Stylemixthemes
  • Pearl
Published: March 26, 2025

CVE-2025-20229

8.0
    Splunk
  • Splunk Enterprise
  • Splunk Cloud Platform
Published: March 26, 2025

CVE-2024-45351

7.8
    Xiaomi
  • Game Center
Published: March 26, 2025

CVE-2025-1912

7.6
    Woocommerce
  • Product Import Export
Published: March 26, 2025

CVE-2025-27404

7.6
    Icinga
  • Icinga Web
Published: March 26, 2025

CVE-2025-27405

7.6
    Icinga
  • Icinga Web
Published: March 26, 2025

CVE-2025-27406

7.6
    Icinga
  • Icinga Reporting
Published: March 26, 2025

CVE-2025-27015

7.5
    Designingmedia
  • Hostiko
Published: March 26, 2025

CVE-2025-26001

7.5
    Telesquare
  • Telesquare Tlr-2005ksh
Published: March 26, 2025

CVE-2025-26009

7.5
    Telesquare
  • Tlr-2005ksh
Published: March 26, 2025

CVE-2025-28361

7.5
    Telesquare
  • Telesquare Tlr-2005ksh
Published: March 26, 2025

CVE-2025-30073

7.5
    Opc
  • Cardsystems Webapp
Published: March 26, 2025

CVE-2025-1514

7.3
    Woocommerce
  • Active Products Tables
Published: March 26, 2025

CVE-2025-2009

7.2
    Wordpress
  • Newsletters Plugin
Published: March 26, 2025

CVE-2025-2257

7.2
    Boldgrid
  • Total Upkeep
Published: March 26, 2025

CVE-2024-13889

7.2
    Wordpress
  • Importer
Published: March 26, 2025

CVE-2025-1913

7.2
    Woocommerce
  • Import Export Product Csv Suite
Published: March 26, 2025

CVE-2025-22283

7.1
    Riyaz
  • Get Social
Published: March 26, 2025

CVE-2025-23459

7.1
    Notfound
  • Ns Simple Intro Loader
Published: March 26, 2025

CVE-2025-23460

7.1
    Notfound
  • Rws Enquiry And Lead Follow Up
Published: March 26, 2025

CVE-2025-23466

7.1
    Wpsiteeditor
  • Site Editor Google Map
Published: March 26, 2025

CVE-2025-23542

7.1
    Robert D Payne
  • Rdp Linkedin Login
Published: March 26, 2025

CVE-2025-23543

7.1
    Notfound
  • Fomo Pay Chinese Payment Solution
Published: March 26, 2025

CVE-2025-23546

7.1
    Notfound
  • Rdp Ingroups
Published: March 26, 2025

CVE-2025-23612

7.1
    Pixobe
  • Cartography
Published: March 26, 2025

CVE-2025-23632

7.1
    Rhizome
  • Cg Button
Published: March 26, 2025

CVE-2025-23633

7.1
    Notfound
  • Wp Database Audit
Published: March 26, 2025

CVE-2025-23638

7.1
    Notfound
  • Frontend Post Submission
Published: March 26, 2025

CVE-2025-23666

7.1
    Notfound
  • Management-Screen-Droptiles
Published: March 26, 2025

CVE-2025-23680

7.1
    Narnoo
  • Notfound Narnoo Operator
Published: March 26, 2025

CVE-2025-23704

7.1
    Reuven Karasik
  • Your Lightbox
Published: March 26, 2025

CVE-2025-23714

7.1
    Notfound
  • Appreview
Published: March 26, 2025

CVE-2025-23728

7.1
    Notfound
  • Aumen
Published: March 26, 2025

CVE-2025-23735

7.1
    Cosmin Schiopu
  • Infugrator
Published: March 26, 2025

CVE-2025-23964

7.1
    Notfound
  • Google Plus
Published: March 26, 2025

CVE-2025-25134

7.1
    Notfound
  • Theme Demo Bar
Published: March 26, 2025

CVE-2025-26536

7.1
    Yendif
  • Another Events Calendar
Published: March 26, 2025

CVE-2025-26541

7.1
    Codesolz
  • Bitcoin Altcoin Payment Gateway
Published: March 26, 2025

CVE-2025-26542

7.1
    Notfound
  • Zalo Live Chat
Published: March 26, 2025

CVE-2025-26544

7.1
    Wordpress
  • Contact Form 7
Published: March 26, 2025

CVE-2025-26546

7.1
    *
  • Notfound Cookies Pro
Published: March 26, 2025

CVE-2025-26560

7.1
    Notfound
  • Wp Contact Form Iii
Published: March 26, 2025

CVE-2025-26564

7.1
    Kagla
  • Gnucommerce
Published: March 26, 2025

CVE-2025-26565

7.1
    Kagla
  • Gnupress
Published: March 26, 2025

CVE-2025-26566

7.1
    Woocommerce
  • In Stock Mailer
Published: March 26, 2025

CVE-2025-26573

7.1
    Notfound
  • Rizzi Guestbook
Published: March 26, 2025

CVE-2025-26575

7.1
    Kyle Maurer
  • Display Post Meta
Published: March 26, 2025

CVE-2025-26576

7.1
    Takumin
  • Wp Simple Slideshow
Published: March 26, 2025

CVE-2025-26579

7.1
    Videowhisper
  • Micro Payments
Published: March 26, 2025

CVE-2025-26581

7.1
    Videowhisper
  • Picture Gallery
Published: March 26, 2025

CVE-2025-26583

7.1
    Videowhisper
  • Video Share Vod
Published: March 26, 2025

CVE-2025-26584

7.1
    Notfound
  • T B Testimonials
Published: March 26, 2025

CVE-2025-27014

7.1
    Designingmedia
  • Hostiko
Published: March 26, 2025

CVE-2025-27267

7.1
    Srcoley
  • Random Quotes
Published: March 26, 2025

CVE-2025-28855

7.1
    Notfound
  • Teleport
Published: March 26, 2025

CVE-2025-28858

7.1
    Arrow Plugins
  • Arrow Maps
Published: March 26, 2025

CVE-2025-28865

7.1
    Lionelroux
  • Wp Colorful Tag Cloud
Published: March 26, 2025

CVE-2025-28869

7.1
    Notfound
  • Notfound Nextgen Gallery Voting
Published: March 26, 2025

CVE-2025-28877

7.1
    Key4ce
  • Osticket Bridge
Published: March 26, 2025

CVE-2025-28880

7.1
    Notfound
  • Blue Captcha
Published: March 26, 2025

CVE-2025-28882

7.1
    Omnify
  • Omnify
Published: March 26, 2025

CVE-2025-28889

7.1
    Notfound
  • Custom Product Stickers For Woocommerce
Published: March 26, 2025

CVE-2025-28890

7.1
    Notfound
  • Lightview Plus
Published: March 26, 2025

CVE-2025-28899

7.1
    Notfound
  • Wp Event Ticketing
Published: March 26, 2025

CVE-2025-28903

7.1
    Notfound
  • Driving Directions
Published: March 26, 2025

CVE-2025-28911

7.1
    Gravity2pdf
  • Gravity 2 Pdf
Published: March 26, 2025

CVE-2025-28917

7.1
    Notfound
  • Custom Smiles
Published: March 26, 2025

CVE-2025-28921

7.1
    Notfound
  • Spatialmatch Idx
Published: March 26, 2025

CVE-2025-28924

7.1
    Notfound
  • Zenphotopress
Published: March 26, 2025

CVE-2025-28928

7.1
    Sureshdsk
  • Are You Robot Google Recaptcha For Wordpress
Published: March 26, 2025

CVE-2025-28934

7.1
    Notfound
  • Simple Post Series
Published: March 26, 2025

CVE-2025-28935

7.1
    Puzich
  • Fancybox Plus
Published: March 26, 2025

CVE-2025-20231

7.1
    Splunk
  • Splunk Enterprise
  • Splunk Secure Gateway
Published: March 26, 2025

CVE-2024-41643

6.8
    Arris
  • Nvg443b
Published: March 26, 2025

CVE-2025-2819

6.6
    Gt-Softcontrol
  • Gt-Softcontrol
Published: March 26, 2025

CVE-2025-1310

6.5
    Wordpress
  • Jobs For Wordpress
Published: March 26, 2025

CVE-2025-26537

6.5
    Notfound
  • Gdpr Tools
Published: March 26, 2025

CVE-2025-26559

6.5
    Notfound
  • Secure Invites
Published: March 26, 2025

CVE-2025-26739

6.5
    Newseqo
  • Newseqo
Published: March 26, 2025

CVE-2025-26747

6.5
    99colorthemes
  • Rainbownews
Published: March 26, 2025

CVE-2025-26869

6.5
    Build
  • Build
Published: March 26, 2025

CVE-2025-26922

6.5
    Techthemes
  • Auramart
Published: March 26, 2025

CVE-2025-26923

6.5
    Bastien Ho
  • Event Post
Published: March 26, 2025

CVE-2025-28885

6.5
    Fiverr
  • Official Search Box
Published: March 26, 2025

CVE-2025-2820

6.5
    *
  • *
Published: March 26, 2025

CVE-2024-55963

6.5
    Appsmith
  • Appsmith
Published: March 26, 2025

CVE-2024-55965

6.5
    Appsmith
  • Appsmith
Published: March 26, 2025

CVE-2025-20228

6.5
    Splunk
  • Splunk Enterprise
  • Splunk Cloud Platform
Published: March 26, 2025

CVE-2025-2838

6.5
    Silicon Labs
  • Gecko Os
Published: March 26, 2025

CVE-2025-2302

6.4
    Wordpress
  • Advanced Woo Search
Published: March 26, 2025

CVE-2025-2573

6.4
    Amazing Service Box
  • Addons For Wpbakery Page Builder
Published: March 26, 2025

CVE-2025-2576

6.4
    Wordpress
  • Plugin
    Ayyash Studio
Published: March 26, 2025

CVE-2025-1784

6.4
    Spectra
  • Spectra Wordpress Gutenberg Blocks
Published: March 26, 2025

CVE-2024-13702

6.4
    Vcita
  • Crm And Lead Management
  • Wordpress Plugin
Published: March 26, 2025

CVE-2025-1437

6.4
    Wordpress
  • Advanced Iframe
Published: March 26, 2025

CVE-2025-1439

6.4
    Wordpress
  • Advanced Iframe
Published: March 26, 2025

CVE-2025-1703

6.4
    Wordpress
  • Ultimate Blocks
Published: March 26, 2025

CVE-2024-13411

6.4
    Zapier
  • Zapier For Wordpress
Published: March 26, 2025

CVE-2025-1312

6.4
    Ultimate Blocks
  • Ultimate Blocks
Published: March 26, 2025

CVE-2025-30407

6.3
    Acronis
  • Cyber Protect Cloud Agent
Published: March 26, 2025

CVE-2025-1490

6.1
    Wordpress
  • Smart Maintenance Mode
Published: March 26, 2025

CVE-2025-2165

6.1
    Wordpress
  • Plugin
Published: March 26, 2025

CVE-2025-26929

5.9
    Patchstack
  • Accounting For Woocommerce
Published: March 26, 2025

CVE-2025-2228

5.7
    Responsive Addons For Elementor
  • Responsive Addons For Elementor
Published: March 26, 2025

CVE-2025-20226

5.7
    Splunk
  • Splunk Enterprise
  • Splunk Cloud Platform
Published: March 26, 2025

CVE-2025-20232

5.7
    Splunk
  • Splunk Enterprise
  • Splunk Cloud Platform
Published: March 26, 2025

CVE-2023-52972

5.5
    Huawei
  • Pcs
Published: March 26, 2025

CVE-2024-30155

5.5
    Hcl
  • Hcl Sx
Published: March 26, 2025

CVE-2025-23203

5.5
    Icinga
  • Icinga Director
Published: March 26, 2025

CVE-2025-2167

5.4
    Wordpress
  • Event Post Plugin
Published: March 26, 2025

CVE-2025-2499

5.4
    Devolutions
  • Remote Desktop Manager
Published: March 26, 2025

CVE-2025-2562

5.4
    Devolutions
  • Remote Desktop Manager
Published: March 26, 2025

CVE-2025-30742

5.3
    Atophttpd
  • Atophttpd
Published: March 26, 2025

CVE-2025-1440

5.3
    Wordpress
  • Advanced Iframe
Published: March 26, 2025

CVE-2025-30225

5.3
    Directus
  • Directus
  • Storage-Driver-S3
Published: March 26, 2025

CVE-2025-30350

5.3
    Directus
  • Storage-Driver-S3
  • Directus
Published: March 26, 2025

CVE-2025-30352

5.3
    Directus
  • Directus
Published: March 26, 2025

CVE-2025-1769

4.9
    Wordpress
  • Product Import Export For Woocommerce
Published: March 26, 2025

CVE-2024-11847

4.8
    Wordpress
  • Wp-Svg-Upload
Published: March 26, 2025

CVE-2022-39163

4.7
    Ibm
  • Cognos Controller
Published: March 26, 2025

CVE-2025-30217

4.6
    Frappe
  • Frappe Framework
Published: March 26, 2025

CVE-2025-2276

4.3
    Wordpress
  • Ultimate Dashboard
Published: March 26, 2025

CVE-2025-24808

4.3
    Discourse
  • Discourse
Published: March 26, 2025

CVE-2025-24972

4.3
    Discourse
  • Discourse
Published: March 26, 2025

CVE-2025-20227

4.3
    Splunk
  • Splunk Enterprise
  • Splunk Cloud Platform
Published: March 26, 2025

CVE-2025-20230

4.3
    Splunk
  • Splunk Enterprise
  • Splunk Secure Gateway App
Published: March 26, 2025

CVE-2025-30164

4.1
    Icinga
  • Icinga Web 2
Published: March 26, 2025

CVE-2025-27551

4.0
    Dbix
  • Dbix Class Encodedcolumn
Published: March 26, 2025

CVE-2025-27552

4.0
    Dbix-Class
  • Encodedcolumn
Published: March 26, 2025

CVE-2025-2528

3.6
    Devolutions
  • Remote Desktop Manager
Published: March 26, 2025

CVE-2024-12683

3.5
    Wordpress
  • Smart Maintenance Mode
Published: March 26, 2025

CVE-2025-30351

3.5
    Directus
  • Directus
Published: March 26, 2025

CVE-2025-31160

2.9
    Atop
  • Atop
Published: March 26, 2025

CVE-2025-1911

2.7
    Woocommerce
  • Import Export Product Csv Suite
Published: March 26, 2025

CVE-2025-20233

2.5
    Splunk
  • Splunk App For Lookup File Editing
Published: March 26, 2025

CVE-2025-2596

2.3
    Checkmk
  • Checkmk
Published: March 26, 2025

CVE-2025-27609

1.1
    Icinga
  • Icinga Web
Published: March 26, 2025

CVE-2025-2600

None
    Devolutions
  • Remote Desktop Manager
Published: March 26, 2025

CVE-2025-29322

None
    Scriptcase
  • Scriptcase
Published: March 26, 2025

CVE-2025-2496

None
    Gitlab
  • Gitlab
Published: March 26, 2025
Click here to see more Vulnerabilities