LuCI: OpenWrt Web Interface
LuCI is the default web-based user interface for OpenWrt. An AI-assisted audit by Hacker House identified multiple vulnerabilities in LuCI components, including…
Tag: XSS
SpyPress: JavaScript Malware Used in Operation RoundPress
SpyPress is an obfuscated JavaScript-based malware used by TA458 in Operation RoundPress. It targets webmail platforms including Roundcube, Zimbra, Kerio, SOGo, and…
CVE-2025-66376: Zimbra Classic UI Cross-Site Scripting Vulnerability
A cross-site scripting (XSS) flaw in Zimbra's Classic UI exploited by Laundry Bear to deploy the ZimReaper payload, harvesting email data from…
Zimbra Patches Critical SNMP Command Injection and Multiple XSS Flaws
Zimbra has released security updates addressing nine vulnerabilities in Zimbra 10.1.20, including a critical command injection flaw in the Simple Network Management…
CVE-2023-37580: Zimbra XSS Vulnerability Exploited by Threat Actors
A cross-site scripting vulnerability in Zimbra that was exploited by threat actors. Part of a series of XSS flaws targeting Zimbra's web…
CVE-2024-27443: Zimbra XSS Vulnerability Exploited by Threat Actors
A cross-site scripting vulnerability in Zimbra that was exploited by threat actors. Part of a series of XSS flaws targeting Zimbra's web…
Zimbra Classic Web Client: XSS Vulnerabilities Patched
The Classic Web Client in Zimbra had four XSS vulnerabilities patched, including stored XSS via attachment filenames and crafted fields.
CVE-2024-42009: Critical Roundcube Cross-Site Scripting Vulnerability
CVE-2024-42009 is a critical cross-site scripting (XSS) vulnerability in Roundcube webmail with a CVSS score of 9.3. Exploitation requires the victim to…
Microsoft Exchange Server
Exchange Server is a mail server and calendaring server developed by Microsoft. It had a stored XSS vulnerability in OWA patched in…