CVE-2026-109391

The Square Squash application (through commit e73f280 ) contains an insecure deserialization vulnerability in its Symbolication API . Unauthenticated attackers can use the POST /api/1.0/symbolication endpoint to store crafted YAML data. When the system processes occurrences referencing an attacke...

Malicious code in @jojoxyz/condemnedforce-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17360 Malicious code in @jojoxyz/condemnedforce-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always me...

Malicious code in @ikanngeming/ikannbail (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17355 Malicious code in @ikanngeming/ikannbail (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

wp2shell-Wordpress-TOWN

wp2shell by : lucifer0xf Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

CVE-2021-43798

CVE-2021-43798 Grafana 8.x Path Traversal Pre-Auth All credits go to j0v and his tweet https://twitter.com/j0v0x0/status/1466845212626542607 Disclaimer This is for educational purposes only. I am not responsible for your actions. Use at your own discretion. In good faith, I've held back releasing...

CVE-2026-63492

The helper "listFFmpegProcesses$keyword" in "plugin/API/standAlone/functions.php" builds a shell pipeline by interpolating "$keyword" inside single quotes and running it with "exec": The two callers in "plugin/API/standAlone/ffmpeg.json.php" the "list" mode and the "isKeywordRunning" mode pass th...

CVE-2026-63494

The standalone FFmpeg execution endpoint "plugin/API/standAlone/ffmpeg.json.php" builds a shell command string that is passed to "execAsync" and run via "nohup sh -c """. When the decrypted "codeToExec" payload produces a non-empty "avideoPath", the endpoint appends a completion hook of the form:...

xwiki-cve-2025-24893-poc

XWiki RCE Exploit PoC CVE-2025-24893 Overview This repository contains a Proof of Concept PoC exploit for the XWiki Remote Code Execution RCE vulnerability identified as CVE-2025-24893. The vulnerability allows an attacker to execute arbitrary code on a target XWiki instance by leveraging a craft...

chamilo-lms-unauthenticated-rce-poc

Chamilo LMS Unauthenticated RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and install the dependenci...

jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17

Docker Commons API Plugin for Jenkins API plugin, which provides the common shared functionality for various Docker-related plugins. Summary API for managing Docker image and container fingerprints Credentials and location of Docker Registry Credentials and location of Docker Daemon aka Docker...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2026-103526 CVE-2026-103526

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protectio...

CVE-2026-103526

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protectio...

CVE-2026-103526 CVE-2026-103526

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protectio...

EUVD-2026-97478

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protectio...

CVE-2026-103526

In Thelia v2.6.0 , the administrative login and forgotten password endpoints exhibit observable response discrepancies when processing invalid usernames and incorrect passwords. This behavior allows unauthenticated attackers to enumerate valid administrator accounts. The lack of rate limiting or ...

nhi-zero-trust-bypass

Project: Exploiting Protocol Vulnerabilities to Manipulate NHI Secrets and Bypass Zero-Trust Policies Screenshots Below are real screenshots from the demonstration. For more, see screenshots/README.md. 1. DNS Exploit BIND Crash A. Exploit Packet Sent Scapy sends a malformed TSIG DNS packet to BIN...