Full Disclosure Mailing List

A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

List Archives

Latest Posts

CyberDanube Security Research 20251215-0 | Multiple Vulnerabilities in Phoenix Contact FL Switch Series Thomas Weber | CyberDanube via Fulldisclosure (Dec 17)
CyberDanube Security Research 20251215-0
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities
product| FL Switch
vulnerable version| 3.40
fixed version| TODO
CVE number| CVE-2025-41692, CVE-2025-41693, CVE-2025-41694,
| CVE-2025-41695, CVE-2025-41696, CVE-2025-41697,
| CVE-2025-41745,...

[KIS-2025-09] Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection Vulnerability Egidio Romano (Dec 17)
------------------------------------------------------------------------------------
Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection
Vulnerability
------------------------------------------------------------------------------------

[-] Software Link:

https://control-webpanel.com

[-] Affected Versions:

Version 0.9.8.1208 and prior versions.

[-] Vulnerability Description:

User input passed via the "key" GET...

Raydium CP Swap: Unchecked Account Allows Creator Fee Hijacking LRKTBEYK LRKTBEYK (Dec 17)
I tried to report these vulnerabilities to ImmuneFi, but they closed it
(report 62070) as "out of scope." I believe them when they tell me
something is out of scope, so now it's public.

https://github.com/raydium-io/raydium-cp-swap/pull/62

These vulnerabilities collectively enable fee theft, creator fee hijacking,
and potential user exploitation through uncapped fee rates. Issue #3 allows
attackers to steal all creator fees from...

[CFP] Security BSidesLjubljana 0x7EA | March 13, 2026 Andraz Sraka (Dec 17)
MMMMMMMMMMMMMMMMNmddmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMN..-..--+MMNy:...-.-/yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMy..ymd-.:Mm::-:osyo-..-mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MM:..---.:dM/..+NNyyMN/..:MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
Mm../dds.-oy.-.dMh--mMds++MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
My:::::/ydMmo..-hMMMmo//omMs/+Mm+++++shNMN+//+//+oMNy+///ohM
MMMs//yMNo+hMh---m:-:hy+sMN..+Mo..os+.-:Ny--ossssdN-.:yyo+mM...

[KIS-2025-08] 1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability Egidio Romano (Dec 15)
------------------------------------------------------------------------------
1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability
------------------------------------------------------------------------------

[-] Software Link:

https://www.1c-bitrix.ru

[-] Affected Versions:

Version 25.100.500 and prior versions.

[-] Vulnerability Description:

The vulnerability is located within the "Translate...

[KIS-2025-07] Bitrix24 <= 25.100.300 (Translate Module) Remote Code Execution Vulnerability Egidio Romano (Dec 15)
-----------------------------------------------------------------------------
Bitrix24 <= 25.100.300 (Translate Module) Remote Code Execution Vulnerability
-----------------------------------------------------------------------------

[-] Software Link:

https://www.bitrix24.com

[-] Affected Versions:

Version 25.100.300 and prior versions.

[-] Vulnerability Description:

The vulnerability is located within the "Translate Module",...

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality Onur Tezcan via Fulldisclosure (Dec 15)
[Attack Vectors]
      > It was identified Cross-Site Request Forgery (CSRF) vulnerability on the "Run now" button of Schedule tasks
functionality. Exploiting this vulnerability, an attacker can run a scheduled task without the victim users consent or
knowledge.

Assigned CVE code:
      > CVE-2025-65593

[Discoverer]
      > AlterSec t/a PenTest.NZ

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality Onur Tezcan via Fulldisclosure (Dec 15)
[Attack Vectors]
      > It was detected that multiple Stored Cross-Site Scripting (Stored XSS) vulnerabilities in the product
management functionality. Malicious JavaScript payloads inserted into the "Product Name" and "Short Description" fields
are stored in the backend database and executed automatically whenever a user (administrator or customer) views the
affected pages.

Assigned CVE code:
    ...

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality. Onur Tezcan via Fulldisclosure (Dec 15)
[Attack Vectors]
      > It was detected that a Stored XSS vulnerability on the "Currencies" functionality, specifically on the
following input field: "Configuration > Currencies > Edit one of the currencies > "Custom formatting" input field.
After saving the payload, the vulnerability can be triggered by visiting the following pages:
- Bestsellers,
- "Sales" > "Orders"...

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area Onur Tezcan via Fulldisclosure (Dec 15)
[Attack Vectors]
      > It was detected that a Stored XSS vulnerability in the "Content Management" > "Blog posts" area. Malicious
HTML/JavaScript added to the Body overview field of a blog post is stored in the backend and executes when the blog
page is visited (http://localhost/blog/)

Assigned CVE code:
     > CVE-2025-65590

[Discoverer]
      > AlterSec t/a PenTest.NZ

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality Onur Tezcan via Fulldisclosure (Dec 15)
[Attack Vectors]
      > It was detected that a Stored XSS vulnerability in the Attributes management workflow. An attacker can insert
JavaScript into the Name field when adding a new Attribute Group (Catalog > Attributes > Specification attributes > Add
Group > Name input field). To exploit the vulnerability, privileged users should visit the "Specification attributes
page.

Assigned CVE code:
    >...

Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group) Yuffie Kisaragi via Fulldisclosure (Dec 15)
UPDATE:

The reported vulnerabilities have now been assigned CVE identifiers:
CVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411
[https://www.cve.org/cverecord?id=CVE-2025-34411]
CVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412
[https://www.cve.org/cverecord?id=CVE-2025-34412]

APPLE-SA-12-12-2025-9 Safari 26.2 Apple Product Security via Fulldisclosure (Dec 15)
APPLE-SA-12-12-2025-9 Safari 26.2

Safari 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125892.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Safari
Available for: macOS Sonoma and macOS Sequoia
Impact: On a Mac with Lockdown Mode enabled, web content opened via a
file URL may...

APPLE-SA-12-12-2025-8 visionOS 26.2 Apple Product Security via Fulldisclosure (Dec 15)
APPLE-SA-12-12-2025-8 visionOS 26.2

visionOS 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125891.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

App Store
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive payment tokens
Description: A...

APPLE-SA-12-12-2025-7 watchOS 26.2 Apple Product Security via Fulldisclosure (Dec 15)
APPLE-SA-12-12-2025-7 watchOS 26.2

watchOS 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125890.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

App Store
Available for: Apple Watch Series 6 and later
Impact: An app may be able to access sensitive payment tokens
Description: A...

More Lists

Dozens of other network security lists are archived at SecLists.Org.