Development

CVE ID : CVE-2025-32878

Published : June 20, 2025, 2:15 p.m. | 28 minutes ago

Description : An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is mainly for downloading firmware files. Before downloading firmware files, the watch requests some information about the firmware via HTTPS from the back-end API. However, the X.509 server certificate within the TLS handshake is not validated by the device. This allows an attacker within an active machine-in-the-middle position, using a TLS proxy and a self-signed certificate, to eavesdrop and manipulate the HTTPS communication. This could be abused, for example, for stealing the API access token of the assigned user account.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-32879

Published : June 20, 2025, 2:15 p.m. | 28 minutes ago

Description : An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device require any authentication or security level. Therefore, any characteristic, depending on their mode of operation (read/write/notify), can be used by the connected attacker. This allows, for example, configuring the device, sending notifications, resetting the device to factory settings, or installing software.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-32880

Published : June 20, 2025, 2:15 p.m. | 28 minutes ago

Description : An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted and allows sniffing and machine-in-the-middle attacks.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-48705

Published : June 20, 2025, 2:15 p.m. | 28 minutes ago

Description : An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sending a crafted BLE message forces the device to reboot.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-48706

Published : June 20, 2025, 2:15 p.m. | 28 minutes ago

Description : An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces the device to reboot.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-6342

Published : June 20, 2025, 2:15 p.m. | 28 minutes ago

Description : A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. This issue affects some unknown processing of the file /admin/admin_football.php. The manipulation of the argument pid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Severity: 7.3 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-6343

Published : June 20, 2025, 2:15 p.m. | 28 minutes ago

Description : A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /admin/admin_product.php. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity: 7.3 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-6344

Published : June 20, 2025, 2:15 p.m. | 28 minutes ago

Description : A vulnerability has been found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /contactus.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Severity: 7.3 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

On this week’s episode of the podcast, freeCodeCamp founder Quincy Larson interviews Kelly Vaughn. She’s a self-taught software engineer who…

In today’s fast-paced digital world, users expect websites and applications to load quickly and run smoothly. Performance optimization in Frontend…

For too long, accessibility has been treated as a fix rather than a foundation, an afterthought rather than a guiding…

Laravel’s RateLimiter clear method enables dynamic rate limit resets based on application conditions. This utility allows programmatic quota management, making…

The Laravel Zap package is a flexible schedule management system with a deep Laravel integration. With Zap, you can create…

Useful Laravel links to read/watch for this week of June 19, 2025. Source: Read More 

To achieve dynamic behavior in Laravel projects, you can use JavaScript, and Vue.js is one of the most popular solutions.…

Cybersecurity researchers have uncovered a new campaign in which the threat actors have published more than 67 GitHub repositories that…

Cloudflare on Thursday said it autonomously blocked the largest ever distributed denial-of-service (DDoS) attack ever recorded, which hit a peak…

Hackers never sleep, so why should enterprise defenses? Threat actors prefer to target businesses during off-hours. That’s when they can…

Imagine for one moment that you are a cybercriminal. You have compromised an organisation’s network, you have stolen their data,…

Iran’s state-owned TV broadcaster was hacked Wednesday night to interrupt regular programming and air videos calling for street protests against…