If your website uses MariaDB database software, there is a security issue that impacts specific versions when a feature called wsrep_notify_cmd is enabled. This flaw lets shell commands hidden in the name of a node that joins a MariaDB cluster run automatically on the server, which could be exploited by unauthorized users to take unwanted actions ...
Continue reading
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and ...
Continue reading
A security flaw has been found in AlanWeb SCADA software. The software fails to require proper authorization to access certain folders on systems where it is installed. This means unauthorized users could read every file stored in those folders, and even run some of the files, including PHP scripts linked to the system's connected database.This ...
Continue reading
A security vulnerability has been identified in Metabase, a common tool used for website data reporting and analysis. This flaw is a type of code injection that allows an unauthenticated (no account required) remote attacker to send unauthorized commands directly to the Metabase application’s database.If exploited, the attacker will gain full ...
Continue reading
