Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To reduce exposure to the krpano flaw behind a 2025 SEO spam campaign, check each tour’s embedding code: change passQueryParameters:true to false or remove the setting, use a restricted parameter allowlist if query parameters are needed, and update to a fixed krpano release. The incident affected sites with vulnerable or permissive configurations—not every krpano installation—and a 2025 count of more than 350 sites is historical, not a measure of current exposure.
What happened in the krpano spam campaign?
In February 2025, security researcher Oleg Zaytsev noticed search results showing apparent adult content on a university website and traced the issue to a krpano-powered virtual tour. SecurityWeek reported that attackers abused older or permissively configured tour pages to redirect visitors to spam destinations; in other cases, advertisements appeared directly on affected pages. Reported spam destinations promoted adult content, diets, hacking services and online casinos. SecurityWeek’s February 27, 2025 report says Zaytsev identified more than 350 exploited websites through Google searches. That was a point-in-time observation, not a verified count of sites still compromised today.
Zaytsev also told SecurityWeek that many affected sites were popular and received millions of visitors monthly, and that some had been targeted multiple times. The report does not provide a methodology or aggregate traffic count, so those figures should be understood as the researcher’s attributed observations, not a measured total.
Recommended Free Tools
The reported mechanism was reflected cross-site scripting (XSS): specially crafted query parameters could cause a tour viewer to handle attacker-controlled content. A compromised tour could make a legitimate host page display spam or redirect visitors. The reporting does not establish that the organizations’ broader web infrastructure or user databases were taken over, nor does it document credential theft or malware infection.
#1 Best Overall
- Think bold. A collection of stickers that capture the Insta360 spirit, freely pasted wherever you like. In the Box: 1x Insta360 X3, 1x Charge Cable, 1x Protective Pouch, 1x Lens Cloth, and 1x User Guide.
- NEW ERA 360 ACTION CAMERA: Insta360 X3 combines 5.7k 360 with all the power of a 4K action camera together. Unbelievable potential!
- 5.7K 360 CAPTURE & REFRAMING: Insta360 X3 captures 360 Active HDR video, with all the benefits of a traditional action camera. Choose your favorite angle after the fact with easy reframing in the AI-powered Insta360 app.
- 4K WIDE-ANGLE SHOTS: Shoot wide-angle footage in maximum resolution with 4K30fps or a super-wide 170° field of view with 2.7K60fps MaxView.
- KEEP FOOTAGE STABLE & LEVEL: FlowState Stabilization and Horizon Lock algorithms work together to deliver incredibly smooth videos.
Which krpano configurations were at risk?
Forwarding every query parameter
The key configuration to inspect is passQueryParameters. krpano’s embedding documentation says that setting it to true passes all URL query parameters to the viewer as variables. SecurityWeek quoted krpano developer Klaus Reinfeld advising operators to change passQueryParameters:true to false, or remove the setting. He said the core default had always been false; older templates could explicitly turn broad parameter passing on.
Allowing parameters through a restricted list
Some query parameters may be necessary for a tour. Rather than pass every parameter, review whether the tour can use a restricted allowlist. krpano’s official release notes say the default HTML template changed in version 1.20.10 to use a limited passQueryParameters list to help prevent potential XSS. The notes also describe restricting deeplinking to numeric startlookat values rather than allowing custom code through the former startactions parameter.
Rank #2
- IMMERSIVE 360 VIDEO - The 8K era is here. Insta360 X4 delivers 360° video in stunning 8K or 5.7K60fps! Use Active HDR to keep shots color accurate too, even in action scenarios.
- SIMPLE, EASY REFRAMING - With Insta360 X4, get out there and shoot, not having to worry about lining up a shot. Shoot first, then reframe easily after, all in the AI-powered Insta360 app.
- INVISIBLE SELFIE STICK EFFECT - The signature third-person Insta360 shot, a specialty of 360 cameras. Immerse your viewers in obstruction-free 360° video, just like you're using a drone or as if you have your own film crew. (Note: The stick is not included in Standalone Version)
- 4K & 170° MAXVIEW - X4 can also be used as a wide-angle 4K action camera at a whopping 4K60fps, or get super wide views with the incredible 170° MaxView at 4K30fps.
- ULTRA STABLE FOOTAGE - FlowState Stabilization and 360° Horizon Lock deliver smooth, level shots, no matter how intense the action is.
Version and configuration both matter
SecurityWeek reported that krpano 1.22.4, released February 24, 2025, included fixes for the issue brought to the developer’s attention and additional improvements. Reinfeld described the reported remaining path as a rare case involving Data-URLs when the xml parameter was explicitly allowed through the query string. He said external XML loading had already been blocked in earlier releases. These details are the developer’s explanation as reported by SecurityWeek, not an independent audit of every krpano deployment.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe release notes also record that version 1.20.10 changed the default template and fixed a problem where passQueryParameters=false did not work. The history is a reason to inspect both the installed version and the actual embedding code: a version number alone does not confirm how a particular page is configured. The notes list krpano 1.23.2 dated September 22, 2025; that dated entry does not establish which version is newest today.
Rank #3
- Big Views, Brilliant Quality - Groundbreaking 1-inch 360° imaging [1] delivers excellent low-light for sharper shots on every adventure. Now with 8K/30fps 360° video, perfect for outdoor sports and travel.
- Stunning, Day or Night - Capture every detail with 8K 360° videos and store them effortlessly with 105GB Built-in Storage. Whether you're exploring city nights or chasing sunrise, your 360 camera delivers crisp, vibrant panoramas, even in low light.
- No Pole, All Action - 1.2m Invisible Selfie Stick turns your Osmo 360 into a cameraman that follows you. Shoot super-smooth 4K/120fps and magical third-person angles. Perfect for skiing: carve, jump, and relive every run.
- Ultra-High-Res 360° Photo - Capture your world in breathtaking detail with this 360 camera. Snap 120MP 360° photos in one tap for immersive, lifelike views you can relive anytime.
- Snap-On Freedom - Switch from 360° selfies to single-lens vlogs in seconds! Magnetic quick‑release works with Osmo Action Quick-Release Adapter Mount; 1/4" thread fits classic gear. Perfect for travel vlogs, cycling POVs — fast, stable, fuss‑free.
How to check and secure a krpano tour
- Inventory tour pages. Find every site and older page that embeds a krpano virtual tour, including pages maintained outside the main application release process.
- Inspect the embedding code. Search the tour’s HTML for
passQueryParameters. If it is set totrue, change it tofalseor remove the setting, following the developer’s recommendation reported by SecurityWeek. - Review needed parameters. Identify which query parameters the tour actually uses. If any must be passed, configure a restricted allowlist rather than forwarding everything, using the approach described in the krpano release notes.
- Update the viewer. Move to a fixed, supported krpano release and consult the vendor’s current release notes. SecurityWeek identifies version 1.22.4 as the release containing fixes for the reported remaining issue.
- Check the page after changes. Review tour pages and relevant search results for unexpected content, embedded ads or redirects, then verify that the changed configuration behaves as intended. The incident report does not provide a universal detection tool or establish whether any particular site remains affected.
Organizations with many legacy sites or limited in-house capacity may consider a professional web application security assessment to inventory tour deployments and review their configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is known—and not known—about the incident’s scale?
The more-than-350 figure applies to websites Zaytsev identified through Google searches, as reported on February 27, 2025. It does not show how many remain exposed, whether the campaign is still active, or whether any named organization has since completed remediation. The available reporting also does not provide a complete list of affected organizations. Treat old indexed results as a reason to check a page, not proof of its current status.
Quick Recap
Rank #4
- 🎥 【4K Digital Camera for Vlogging-Made for Beginners & First-Time Content Creators】Shoot stunning 4K video and capture 75MP photos for clear, shareable content. Create eye-catching videos without complicated settings. This easy-to-use camera is perfect for YouTube, TikTok, travel vlogs, and daily recording. Fast autofocus and a wide-angle lens ensure sharp and stable footage
- 🌍【 Portable Pocket Camera for Travel & Daily Use】Compact and lightweight, this portable camera easily fits in your pocket—perfect for travel, vacations, outdoor trips, hiking, and everyday life recording. Capture high-quality moments anytime, anywhere
- 🎬【Perfect for Solo Vlogging】Film yourself with confidence using the unique 330° rotating lens. Create travel vlogs, daily videos and outdoor content with natural-looking framing and less camera adjustment. Also supports time-lapse, slow motion and interval shooting for more creative storytelling.
- 📱【WiFi Digital Camera for Content Creators】Built-in WiFi lets you wirelessly transfer photos and videos to your smartphone for quick editing and sharing. Perfect for YouTube, TikTok and social media content.
- 📦 【 Vlogging Camera Kit with Accessories & Warranty】Comes with essential accessories so you can start filming immediately—no extra setup needed. Includes a camera, 16GB TF card, mini tripod, charging cable, wrist strap, and travel carrying bag. A perfect beginner camera kit, backed by 24/7 support and a 1-year warranty
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
