Jul 18, 2025
3 new incidents, 0 with updates.
Started
- ClosedPatched
Fortinet FortiWeb: FortiWeb SQL Injection Vulnerability
Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. Added to CISA KEV on 2025-07-18.
Fortinet FortiWebClosed Jul 18, 2025
- ClosedPatched
ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)
Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.
Microsoft SharePoint Server (on-premises)Closed Jul 22, 2025
- ClosedPatched
eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)
A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.
npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, isClosed Jul 22, 2025
