Aggregator

Google计划整合ChromeOS与Android；Commodore推出复古游戏机；英伟达为RTX40系列显卡引入Smooth Motion技术；微软延长Windows10上Microsoft365的支持时间；xAI与Anthropic推出政府版AI产品；彭博社称Apple考虑收购法国AI公司Mistral；少数派发布多款产品及活动信息。

黄仁勋雷军合照曝光；理想 i8 纯电 SUV 黑武士版亮相，新车 7 月 29 日上市；鸿蒙智行首款旅行车享界 S9T 无伪装实车图曝光

疑似某黑产新型远控勒索样本分析

CSOP 2025·北京站 亮点前瞻

一个开放的黑客社区，帮助新手成长为专家。提供学习、提问和解答的机会，并通过Discord进行交流。

铁路End-of-Train和Head-of-Train系统存在20年安全漏洞，攻击者可利用500美元无线电设备发送伪造刹车指令，导致列车紧急制动或脱轨。该漏洞未被修复，威胁铁路安全。

A 20-year-old flaw in End-of-Train and Head-of-Train systems could let hackers trigger emergency braking, finally getting proper attention. US CISA has warned about a critical flaw, tracked as CVE-2025-1727, in the radio-based linking protocol between End-of-Train (EoT) and Head-of-Train (HoT) systems. An End-of-Train (EoT) device, also known as a Flashing Rear End Device (FRED), is […]

GoExec is a new take on some of the methods used to gain remote execution on Windows devices. GoExec implements a number of largely unrealized execution methods and provides significant OPSEC improvements overall. Goexec supports...

The post GoExec: Next-Gen Remote Execution Tool Boosts OPSEC for Windows Attacks appeared first on Penetration Testing Tools.

A zero-click exploit called EchoLeak reveals how AI assistants like Microsoft 365 Copilot can be manipulated to leak sensitive data without user interaction. This entry breaks down how the attack works, why it matters, and what defenses are available to proactively mitigate this emerging AI-native threat.

保护数据全生命周期安全流转。

A vulnerability was found in SEMCMS 5.0 and classified as critical. Affected by this issue is some unknown functionality of the file SEMCMS_Categories.php. The manipulation of the argument pid leads to sql injection. This vulnerability is handled as CVE-2025-51652. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in SEMCMS 5.0. It has been classified as critical. This affects an unknown part of the file SEMCMS_ct.php. The manipulation of the argument pid leads to sql injection. This vulnerability is uniquely identified as CVE-2025-51653. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in SEMCMS 5.0. It has been rated as critical. This issue affects some unknown processing of the file SEMCMS_Link.php. The manipulation of the argument ID leads to sql injection. The identification of this vulnerability is CVE-2025-51656. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in SEMCMS 5.0. Affected by this issue is some unknown functionality of the file SEMCMS_InquiryView.php. The manipulation of the argument ID leads to sql injection. This vulnerability is handled as CVE-2025-51658. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in SEMCMS 5.0 and classified as critical. This vulnerability affects unknown code of the file SEMCMS_Products.php. The manipulation of the argument lgid leads to sql injection. This vulnerability was named CVE-2025-51660. The attack can be initiated remotely. There is no exploit available.

A vulnerability has been found in Shopify job-iteration up to 1.10.x and classified as critical. Affected by this vulnerability is an unknown functionality of the component CSV File Parser. The manipulation leads to os command injection. This vulnerability is known as CVE-2025-53623. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.