Understanding the Recent Vulnerability in CMSsite 1.0 CMSsite 1.0 recently faced a significant security threat due to a SQL injection vulnerability (CVE-2019-25674). This vulnerability allows unauthenticated attackers to manipulate database queries by injecting malicious SQL code. Such vulnerabilities can lead to unauthorized access to sensitive database information, making it crucial for system administrators and hosting […]

Understanding the eDirectory SQL Injection Vulnerability The recent discovery of multiple SQL injection vulnerabilities in eDirectory has raised significant concerns among system administrators and hosting providers. This vulnerability (CVE-2019-25675) allows attackers to bypass authentication and access sensitive files without any prerequisite credentials. What is CVE-2019-25675? This vulnerability is specifically tied to SQL injection, which is […]

Understanding the Recent Vulnerability in CMSsite 1.0 CMSsite 1.0 recently faced a significant security threat due to a SQL injection vulnerability (CVE-2019-25674). This vulnerability allows unauthenticated attackers to manipulate database queries by injecting malicious SQL code. Such vulnerabilities can lead to unauthorized access to sensitive database information, making it crucial for system administrators and hosting […]

Understanding the eDirectory SQL Injection Vulnerability The recent discovery of multiple SQL injection vulnerabilities in eDirectory has raised significant concerns among system administrators and hosting providers. This vulnerability (CVE-2019-25675) allows attackers to bypass authentication and access sensitive files without any prerequisite credentials. What is CVE-2019-25675? This vulnerability is specifically tied to SQL injection, which is […]

Our Attack Vector Miner (based on AI) is a very effective tool to identify 0. day attacks. Here comes the first catch! Discovery of a New Botnet At the beginning of July, our Attack Vector Miner created a new cluster, filled with logs about a new type of botnet. We perceived the first incident on […]

In the preceding articles, I’ve talked a lot about the BitNinja safe minimum ruleset template and how you should enable it on your “/” location (or on “*/wp-admin/*” if needed) if you’re hosting mainly WordPress websites. So I’d like to give you a little more explanation about the rules that are part of the safe […]

Content Management Systems (CMS) are highly vulnerable to zero-day attacks recently. Lately, the Drupal was picked on by the hackers. Now the ModX CMS is in the target. CVE-2018-1000207: The new MODX vulnerability Two critical vulnerabilities have been found in MODX Revolution <= 2.6.4 in the past few days. Exploiting it, the hackers can remote […]

We are checking in with an unusual article. We would like to share an upcoming story about a great Journey, which will start on 28th of July. Why is it worth mentioning? Well, one member of this great Adventure is one of our Ninjas, and we’re really proud of him. They will travel around Northern […]

Artificial Intelligence (AI) is spreading quickly in many industries, and we can gladly announce the Attack Vector Miner, one of our latest developments based on AI. But before we tell you more about that, let’s get a bit more familiar with AI. If you’re an AI expert, know everything about it, and are only curious […]

Last time we finished off with the advice that if you’re hosting mainly WordPress websites, you should only enable the BitNinja Safe Minimum ruleset for the “/” location or any other domain pattern that contains “/wp-admin”. So let’s talk a bit more about domain patterns With the BitNinja WAF, we’d like to give you the […]

New LogAnalysis with 109x speed The former version of SenseLog (which serves our robust LogAnalysis module) has processed the files at the start and observed them if there were any changes in them. It has used a lot of sources for the dates in the log rows. In this version it was necessary because SenseLog […]

A new flaw on the horizon! A new flaw has been discovered in phpMyAdmin, in which an attacker has the possibility to include files on the server. This vulnerability is caused because of a portion of a code where the pages are redirected and loaded in phpMyAdmin. Here are the steps, how it can be […]

We know that our customers care a lot about their own customers, too. Just like we care about you, and about making the internet a safer place. So, with the following series of articles titled “Wordpress hosting and the BitNinja WAF - how to do it right?”, I’d like to help those who work in WordPress hosting, […]

Understanding CVE-2019-25676 The cybersecurity landscape is constantly evolving, and recently a high-impact vulnerability has emerged concerning the Ask Expert Script 3.0.5. This vulnerability, known as CVE-2019-25676, exposes systems to significant risks from unauthenticated attackers. Understanding its implications is crucial for all system administrators and hosting providers. What is CVE-2019-25676? CVE-2019-25676 is a critical vulnerability that […]

Introduction to CVE-2019-25678 CVE-2019-25678 reveals critical SQL injection vulnerabilities in the C4G Basic Laboratory Information System (BLIS) version 3.4. This security flaw allows attackers to execute arbitrary SQL commands. Server administrators and hosting providers must understand the implications to safeguard their systems. Understanding the Threat Attackers can exploit these vulnerabilities by sending GET requests to […]

Understanding CVE-2026-5538 and Its Impact on Server Security A recently discovered vulnerability, CVE-2026-5538, has been identified in QingdaoU OnlineJudge software, affecting versions up to 1.6.1. This vulnerability allows for server-side request forgery, which can be exploited remotely. System administrators and hosting providers must be vigilant to protect their infrastructures against this type of attack. Details […]