#!/usr/bin/env python3 # Exploit Title: Grandstream GSD3710 1.0.11.13 – Stack Buffer Overflow # Google Dork: [if applicable] # Date: 2025-05-23 # Exploit Author: Pepelux (user in ExploitDB) # Vendor Homepage: https://www.grandstream.com/ # Software Link: [download link if available] # Version: Grandstream GSD3710 – firmware:1.0.11.13 and lower # Tested on: Linux and MacOS # CVE:…
# Exploit Title: Microsoft Windows Server 2016 – Win32k Elevation of Privilege # Date: 2025-05-19 # Exploit Author: Milad Karimi (Ex3ptionaL) # Contact: miladgrayhat@gmail.com # Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL # Country: United Kingdom # CVE : CVE-2023-29336 #include #include #include #define IDM_MYMENU 101 #define IDM_EXIT 102 #define IDM_DISABLE 0xf120 …
Research by: hasherezade Process Injection is one of the important techniques in the attackers’ toolkit. In the constant cat-and-mouse game, attackers try to invent its new implementations that bypass defenses, using creative methods and lesser-known APIs. Combining common building blocks in an atypical way, Check Point Research was able to create a much stealthier version…
Highlights Check Point Research has been tracking an advanced phishing campaign conducted by APT29, a Russia linked threat group, which is targeting diplomatic entities across Europe. The campaign, which appears to be a continuation of a previous one that utilized a backdoor known as WINELOADER, impersonates a major European foreign affairs ministry to distribute fake invitations to diplomatic…
Key Points CVE-2025-24054 is a vulnerability related to NTLM hash disclosure via spoofing, which can be exploited using a maliciously crafted .library-ms file. Active exploitation in the wild has been observed since March 19, 2025, potentially allowing attackers to leak NTLM hashes or user passwords and compromise systems. Although Microsoft released a patch on March…
For the latest discoveries in cyber research for the week of 21st April, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Retail giant Ahold Delhaize has suffered a cyber-attack resulting in data theft of customer information from its US business systems. The attack, claimed by ransomware group INC Ransom, impacted Ahold Delhaize USA…
#!/usr/bin/env python3 # Exploit Title: WordPress User Registration & Membership Plugin 4.1.2 – Authentication Bypass # Date: 2025-05-22 # Exploit Author: Mohammed Idrees Banyamer # Vendor Homepage: https://wordpress.org/plugins/user-registration/ # Software Link: https://downloads.wordpress.org/plugin/user-registration.4.1.2.zip # Version: <= 4.1.2 # Tested on: WordPress 6.x, Apache on Linux # CVE: CVE-2025-2594 import requests import sys import argparse from…
ISC Stormcast For Thursday, June 12th, 2025 https://isc.sans.edu/podcastdetail/9490, (Thu, Jun 12th) Source link
For the latest discoveries in cyber research for the week of 28th April, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES British retailer Marks & Spencer (M&S) experienced a cyber-attack that caused disruptions to its online order system and in-store contactless payments. The company suspended online orders temporarily, refunded some customers, and reported…
Tor Browser 14.5.1 is now available from the Tor Browser download page and also from our distribution directory. This version includes important security updates to Firefox. Send us your feedback If you find a bug or have a suggestion for how we could improve this release, please let us know. Full changelog The full changelog…
