[每日信息流] 2025-12-29

# 每日安全资讯（2025-12-29）

- CXSECURITY Database RSS Feed - CXSecurity.com
  - [ ] [Wordpress (Easy Hide Login) plugin Stored XSS](https://cxsecurity.com/issue/WLB-2025120032)
  - [ ] [Birth Chart Compatibility WordPress Plugin 2.0 Full Path Disclosure](https://cxsecurity.com/issue/WLB-2025120031)
- Private Feed for M09Ic
  - [ ] [safedv starred badsectorlabs/ludus](https://github.com/badsectorlabs/ludus)
  - [ ] [xnl-h4ck3r released v7.4 at xnl-h4ck3r/waymore](https://github.com/xnl-h4ck3r/waymore/releases/tag/v7.4)
  - [ ] [bolucat released 202512281936 at bolucat/Archive](https://github.com/bolucat/Archive/releases/tag/202512281936)
  - [ ] [mgeeky starred vllm-project/vllm](https://github.com/vllm-project/vllm)
  - [ ] [joaoviictorti starred BloopAI/vibe-kanban](https://github.com/BloopAI/vibe-kanban)
  - [ ] [xpn starred badsectorlabs/ludus](https://github.com/badsectorlabs/ludus)
  - [ ] [FunnyWolf starred hunters-ai/ocsf-mapping-public](https://github.com/hunters-ai/ocsf-mapping-public)
  - [ ] [Mr-xn starred ComposioHQ/awesome-claude-skills](https://github.com/ComposioHQ/awesome-claude-skills)
  - [ ] [ourren starred lintsinghua/DeepAudit](https://github.com/lintsinghua/DeepAudit)
  - [ ] [CHYbeta starred PurpleAILAB/Decepticon](https://github.com/PurpleAILAB/Decepticon)
  - [ ] [Fplyth0ner-Combie starred ceso/ceso.github.io](https://github.com/ceso/ceso.github.io)
  - [ ] [gh0stkey starred joe-desimone/mongobleed](https://github.com/joe-desimone/mongobleed)
  - [ ] [Rvn0xsy starred paperless-ngx/paperless-ngx](https://github.com/paperless-ngx/paperless-ngx)
- SecWiki News
  - [ ] [SecWiki News 2025-12-28 Review](http://www.sec-wiki.com/?2025-12-28)
- Recent Commits to cve:main
  - [ ] [Update Sun Dec 28 11:38:43 UTC 2025](https://github.com/trickest/cve/commit/d4236428807475addb2c9fda86d87e3240f6f732)
- Doonsec's feed
  - [ ] [0106.我如何在漏洞赏金第一年就赚到六位数：我的经验](https://mp.weixin.qq.com/s?__biz=MzA4NDQ5NTU0MA==&mid=2647691593&idx=1&sn=3e464fe7410a6dc971925ca1a1a0902b)
  - [ ] [安全锐评：为什么信息安全部门会被一刀裁掉](https://mp.weixin.qq.com/s?__biz=MzA5OTEyNzc1Nw==&mid=2247487200&idx=1&sn=f09a4c23a914d576fd25added54eaf8f)
  - [ ] [隐藏 API 端点发现指南](https://mp.weixin.qq.com/s?__biz=MzAxOTM1MDQ1NA==&mid=2451184491&idx=1&sn=04f45640209cf32e9cc1d0a7ce817850)
  - [ ] [【重大更新】EasyTools渗透测试工具箱v2.0.5（它支持自定义主题啦，不再是以前那单调的白，同时优化诸多允许逻辑bug）](https://mp.weixin.qq.com/s?__biz=MzkxNDYxMTc0Mg==&mid=2247484688&idx=1&sn=66e4a1510be5adb03d0d82abf8bdf09e)
  - [ ] [利刃信安 惊天大瓜 速看，随时删除](https://mp.weixin.qq.com/s?__biz=MzUyMzE1MzI3NA==&mid=2247486831&idx=1&sn=9d8fb26845acd6811c39d7afb5232e95)
  - [ ] [HG第二届发起人线下见面会南京圆满收官：荣誉加冕，共赴新程](https://mp.weixin.qq.com/s?__biz=Mzg5NzczODE5Ng==&mid=2247483825&idx=1&sn=1c430ed3d2eb5a1cb9b61304fa514c54)
  - [ ] [Splunk Basics - Did you SIEM?](https://mp.weixin.qq.com/s?__biz=Mzg4NzU4MDE5NQ==&mid=2247484812&idx=1&sn=62206442a6c0a1bdf0842aa3f5e734cb)
  - [ ] [第十九届全国大学生信息安全竞赛暨长城杯（防护赛）初赛WP](https://mp.weixin.qq.com/s?__biz=MzkyMDcyODYwNw==&mid=2247488065&idx=1&sn=e90a39b5fff1d2840dbc083ffcd51f5a)
  - [ ] [从 “听不懂” 到 “说了算”！运维必学的异步 / 多线程实战技巧，10 分钟上手](https://mp.weixin.qq.com/s?__biz=MzAxMDM2OTg4NA==&mid=2247484770&idx=1&sn=a1fcecf66e794c4b5c16bf1fd851d724)
  - [ ] [2025年终回顾：万亿威胁与资本，到底能不能吹走网安颓势？](https://mp.weixin.qq.com/s?__biz=MzAxOTk3NTg5OQ==&mid=2247493499&idx=1&sn=e060674b7336afe37c10556cce8dcfa8)
  - [ ] [第十九届全国大学生信息安全竞赛（创新实践能力赛）暨第三届“长城杯” 网数智安全大赛（防护赛）初赛 题目分享](https://mp.weixin.qq.com/s?__biz=MzE5MTEzNzcwNg==&mid=2247485296&idx=1&sn=10bc881af5937aef0faade19be115996)
  - [ ] [xingrin——自动化资产发现与漏洞扫描系统](https://mp.weixin.qq.com/s?__biz=MzE5ODA3NjAzNg==&mid=2247485239&idx=1&sn=1c41acb5ce4b0afc1e8aa668589896f9)
  - [ ] [【已复现】MongoDB 未授权内存泄露漏洞（CVE-2025-14847）](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247493033&idx=1&sn=153b8c986cc2a5c1992934f0b292203e)
  - [ ] [长城杯不是团队赛吗，怎么我在打个人赛？](https://mp.weixin.qq.com/s?__biz=Mzk3NTkzNDQ2NQ==&mid=2247485842&idx=1&sn=83628b53ab5036b4913ff3f16d11c3e8)
  - [ ] [【情报知识】战术、战役、战略情报/间*](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651153454&idx=1&sn=37c7af9addd913f701dda757940a1a1a)
  - [ ] [【资料】中央情报局（CIA)与行为科学：精神控制、药物实验和MKULTRA计划](https://mp.weixin.qq.com/s?__biz=MzI2MTE0NTE3Mw==&mid=2651153454&idx=2&sn=8803524fdc0f90923afadb26a25cfa05)
  - [ ] [初赛WP|第十九届全国大学生信息安全竞赛 （创新实践能力赛）暨第三届“长城杯” 网数智安全大赛（防护赛）初赛WriteUP](https://mp.weixin.qq.com/s?__biz=MzI2MTY3MzI2NQ==&mid=2247484382&idx=1&sn=e7faeab19c60a8545e5277f86e14dda1)
- 安全分析与研究
  - [ ] [俄罗斯Gamaredon APT组织针对乌克兰的网络攻击活动](https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247495079&idx=1&sn=2fa5c2fe80bdffc497265f13e62957c8)
- 黑鸟
  - [ ] [隐藏 API 端点发现指南](https://mp.weixin.qq.com/s?__biz=MzAxOTM1MDQ1NA==&mid=2451184491&idx=1&sn=04f45640209cf32e9cc1d0a7ce817850)
- 奇客Solidot–传递最新科技情报
  - [ ] [逾四成 GNOME Core 应用用 C 语言开发](https://www.solidot.org/story?sid=83164)
  - [ ] [YouTube 向新用户推荐的信息流逾五分之一含有 AI 垃圾](https://www.solidot.org/story?sid=83163)
  - [ ] [多地提出公务员录用将网络言行纳入考察](https://www.solidot.org/story?sid=83162)
- 吾爱破解论坛
  - [ ] [FlowMouse - 心流鼠标手势 v1.1 Chrome 应用商店已更新！
👉 安装链接：https://chrome.google.com/webstore/detail/fnldhkfidchnjiokpoemdhoejmaojkgp

✅本次更新重点解决 Mac 菜单冲突问题，并带来多项实用升级，更多详细内容，请查看版本发布说明。

✨ 欢迎下载体验！如果觉得好用，不妨给我们一个五星好评支持。
📢 如有任何建议或反馈，也欢迎随时留言告诉我们。

⚠️ 注意事项：
由于新增图片保存功能，插件需申请下载权限，因此更新后可能会被停用。请在更新后手动重新启用插件，即可正常使用。](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651143251&idx=1&sn=81472c21e1be29646d2b1fdf900bdcaf)
- 威努特安全网络
  - [ ] [破解企业流量难题！威努特应用交付系统智能护航](https://mp.weixin.qq.com/s?__biz=MzAwNTgyODU3NQ==&mid=2651139084&idx=1&sn=7db72be2728b284520fb853ba7bf0f87)
- 二道情报贩子
  - [ ] [育碧遭遇大规模数据泄露，近三十年游戏源代码或已失窃](https://mp.weixin.qq.com/s?__biz=MzU5NTA3MTk5Ng==&mid=2247489901&idx=1&sn=f48372aa3982bda8ebf44abc309d982a)
- 天黑说嘿话
  - [ ] [【BurpSuite插件】Xia Sql二开插件，扫描效率大幅提升，简直是安全仔的梦中神器！](https://mp.weixin.qq.com/s?__biz=MzI5NTQ5MTAzMA==&mid=2247485904&idx=1&sn=4ff33be02f89b3a7055d6e7e3c9568bb)
- 长亭安全应急响应中心
  - [ ] [【已复现】MongoDB 未授权内存泄露漏洞（CVE-2025-14847）](https://mp.weixin.qq.com/s?__biz=MzIwMDk1MjMyMg==&mid=2247493033&idx=1&sn=153b8c986cc2a5c1992934f0b292203e)
- 安全圈
  - [ ] [【安全圈】70余万条学生信息被多次贩卖！副校长买，平台工程师偷，中间还倒了几次手](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652073438&idx=1&sn=8b040749b9d530d6bfdbc0b0ac1f1afb)
  - [ ] [【安全圈】暗网出现1.97TB罗技数据](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652073438&idx=2&sn=463ad19dfde9b34dc3e11519b3df47f5)
  - [ ] [【安全圈】Coinbase：涉 5 月客户数据泄露案的前客服人员在印度被捕](https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652073438&idx=3&sn=b7dfb470f9169b82520842331f12fa90)
- 电子物证
  - [ ] [【图片突然损坏怎么办？】](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651048870&idx=1&sn=11f824a93257e0766135adbddb71dc3b)
  - [ ] [技术分享：SQL Server数据库取证技术指南](https://mp.weixin.qq.com/s?__biz=MzAwNDcwMDgzMA==&mid=2651048870&idx=2&sn=36d2457c4315cf701189f3bc0a6d7cae)
- 极客公园
  - [ ] [「DD 旗舰」，零跑想要「领跑」下个 10 年的野心](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653095797&idx=1&sn=749cba98cdd44894b0ad0bf7c764160e)
  - [ ] [B 站公布「年度弹幕」；官方发「AI 替代」劳动仲裁案例；传初代彩壳 AirPods 现身 | 极客早知道](https://mp.weixin.qq.com/s?__biz=MTMwNDMwODQ0MQ==&mid=2653095767&idx=1&sn=373ef4bb65eda4ad3bc226f75099ef40)
- 表图
  - [ ] [从豆包手机风波看通用 AI Agent 的困局与出路](https://mp.weixin.qq.com/s?__biz=MzUzOTI4NDQ3NA==&mid=2247484947&idx=1&sn=3f34cf102ddf8d66523e9db6e96ee14b)
- Over Security - Cybersecurity news aggregator
  - [ ] [Exploited MongoBleed flaw leaks MongoDB secrets, 87K servers exposed](https://www.bleepingcomputer.com/news/security/exploited-mongobleed-flaw-leaks-mongodb-secrets-87k-servers-exposed/)
  - [ ] [Hacker claims to leak WIRED database with 2.3 million records](https://www.bleepingcomputer.com/news/security/hacker-claims-to-leak-wired-database-with-23-million-records/)
  - [ ] [Massive Rainbow Six Siege breach gives players billions of credits](https://www.bleepingcomputer.com/news/security/massive-rainbow-six-siege-breach-gives-players-billions-of-credits/)
  - [ ] [WIRED - 2,364,431 breached accounts](https://haveibeenpwned.com/Breach/WIRED)
- 迪哥讲事
  - [ ] [账户接管新思路](https://mp.weixin.qq.com/s?__biz=MzIzMTIzNTM0MA==&mid=2247498858&idx=1&sn=abe538cc9d3af390726fd458300530a1)
- IT Service Management News
  - [ ] [Bloccare l'IA dai browser](http://blog.cesaregallotti.it/2025/12/bloccare-lia-dai-browser.html)
- Dark Space Blogspot
  - [ ] [Leggende Metropolitane Cittadine e Su Internet: Dagli Anni 80 In Poi](http://darkwhite666.blogspot.com/2025/12/leggende-metropolitane-cittadine-e-su.html)
- 希潭实验室
  - [ ] [第145篇：美国斯诺登棱镜门事件的技术细节揭秘：通过互联网巨头窃听全球用户数据](https://mp.weixin.qq.com/s?__biz=MzkzMjI1NjI3Ng==&mid=2247488058&idx=1&sn=38d33e418ac06feb154e8238f1c411fd)
- SANS Internet Storm Center, InfoCON: green
  - [ ] [ISC Stormcast For Sunday, December 28th, 2025 https://isc.sans.edu/podcastdetail/9750, (Sun, Dec 28th)](https://isc.sans.edu/diary/rss/32590)
- Troy Hunt's Blog
  - [ ] [Weekly Update 484](https://www.troyhunt.com/weekly-update-484/)
- Security Affairs
  - [ ] [Condé Nast faces major data breach: 2.3M WIRED records leaked, 40M more at risk](https://securityaffairs.com/186224/data-breach/conde-nast-faces-major-data-breach-2-3m-wired-records-leaked-40m-more-at-risk.html)
  - [ ] [Stolen LastPass backups enable crypto theft through 2025](https://securityaffairs.com/186191/digital-id/stolen-lastpass-backups-enable-crypto-theft-through-2025.html)
  - [ ] [SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 77](https://securityaffairs.com/186206/malware/security-affairs-malware-newsletter-round-76-2.html)
  - [ ] [Security Affairs newsletter Round 556 by Pierluigi Paganini – INTERNATIONAL EDITION](https://securityaffairs.com/186200/breaking-news/security-affairs-newsletter-round-556-by-pierluigi-paganini-international-edition.html)
- The Register - Security
  - [ ] [Death, torture, and amputation: How cybercrime shook the world in 2025](https://go.theregister.com/feed/www.theregister.com/2025/12/28/death_torture_and_amputation_how/)
- Deeplinks
  - [ ] [EFFector Audio Speaks Up for Our Rights: 2025 Year in Review](https://www.eff.org/deeplinks/2025/12/effector-audio-speaks-our-rights-2025-year-review)
  - [ ] [Procurement Power—When Cities Realized They Can Just Say No: 2025 in Review](https://www.eff.org/deeplinks/2025/12/procurement-power-when-cities-realized-they-can-just-say-no-2025-review)
  - [ ] [Defending Encryption in the U.S. and Abroad: 2025 in Review](https://www.eff.org/deeplinks/2025/12/defending-encryption-us-and-abroad-2025-review)
- Full Disclosure
  - [ ] [[KIS-2025-14] PKP-WAL <= 3.5.0-1 Login Cross-Site Request	Forgery Vulnerability](https://seclists.org/fulldisclosure/2025/Dec/36)
  - [ ] [[KIS-2025-13] PKP-WAL <= 3.5.0-3 (X-Forwarded-Host) LESS Code Injection Vulnerability](https://seclists.org/fulldisclosure/2025/Dec/35)
  - [ ] [[KIS-2025-12] PKP-WAL <= 3.5.0-1 (baseColour) LESS Code	Injection Vulnerability](https://seclists.org/fulldisclosure/2025/Dec/34)
  - [ ] [[KIS-2025-11] Open Journal Systems <= 3.5.0-1 (NativeXmlIssueGalleyFilter.php) Path Traversal Vulnerability](https://seclists.org/fulldisclosure/2025/Dec/33)
  - [ ] [[KIS-2025-10] PKP-WAL <= 3.5.0-1 (Institution Collector) SQL Injection Vulnerability](https://seclists.org/fulldisclosure/2025/Dec/32)
  - [ ] [Backdoor.Win32.Poison.jh / Insecure Permissions](https://seclists.org/fulldisclosure/2025/Dec/31)
  - [ ] [Backdoor.Win32.Netbus.170 / Insecure Credential Storage /	MVID-2025-0703](https://seclists.org/fulldisclosure/2025/Dec/30)
- TorrentFreak
  - [ ] [Cloudflare Reports Surge in Streaming Piracy Takedowns, Removes 20k+ Storage Accounts](https://torrentfreak.com/cloudflare-reports-surge-in-streaming-piracy-takedowns-removes-20k-storage-accounts/)


Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[每日信息流] 2025-12-29 #1097

每日安全资讯（2025-12-29）

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[每日信息流] 2025-12-29 #1097

Description

每日安全资讯（2025-12-29）

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions