CTF Archive: Capture, Curate, Learn Forever

Capture the Flag CTF competitions represent a powerful experiential learning approach within cybersecurity education, blending diverse concepts into interactive challenges. However, the short duration typically 24-48 hours and ephemeral infrastructure of these events often impede sustained...

Malicious Package

Overview @vleo-dev/a11y-js-service is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

The vulnerability of the ConnectWise Automate platform for remote monitoring and management, related to the transmission of critical information in plaintext, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ConnectWise Automate platform for remote monitoring and control is related to the transmission of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protecte...

The vulnerability of the __nvmet_reqComplete() function in the drivers/nvme/target/core.c module of the Linux NVME kernel driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nvmetreqComplete function in the drivers/nvme/target/core.c file of the Linux kernel’s NVME support module is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the crtcdebugfs_init() function in the drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dmdebugfs.c driver module of the Direct Rendering Infrastructure (DRI) support for AMD graphics cards in Linux operating systems allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the crtcdebugfsinit function in the drivers/gpu/drm/amd/display/amdgpudm/amdgpudmdebugfs.c driver module of the Direct Rendering Infrastructure DRI support for AMD graphics cards in Linux operating systems is related to the lack of memory release after the effective lifespan ...

The vulnerability of the IP video surveillance system lies in the use of strictly encrypted credentials, which allows intruders to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the IP video surveillance system “Line” lies in the use of strictly encrypted credentials. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Building Browser Agents: Architecture, Security, and Practical Solutions

Browser agents enable autonomous web interaction but face critical reliability and security challenges in production. This paper presents findings from building and operating a production browser agent. The analysis examines where current approaches fail and what prevents safe autonomous operatio...

CVE-2025-66112

Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through = 2.0.4...

CVE-2025-66112 WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through = 2.0.4...

EUVD-2025-198442

Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through = 2.0.4...

CVE-2025-66112

CVE-2025-66112 concerns a missing authorization issue in the WordPress plugin bundle described as “Accessibility Toolkit by WebYes accessibility-plus,” specifically affecting versions up to and including 2.0.4. Multiple connected sources describe it as a broken access control vulnerability due to...

PT-2025-47774

Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through = 2.0.4...

The vulnerability of the WebGPU API interface in Mozilla Firefox and the Thunderbird email client allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebGPU API interface in Mozilla Firefox and the Thunderbird email client is related to incorrect handling of exceptional states. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

CVE-2025-66112: Missing Authorization

Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through = 2.0.4...

WordPress plugin Accessibility Toolkit by WebYes 安全漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin Accessibility Toolkit by WebYes, which...

The vulnerability of the Kapsch TrafficCom RIS-9260 road communication module lies in the lack of authentication for a critical function, allowing a violator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Kapsch TrafficCom RIS-9260 road communication module’s microprogramming software is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker operating remotely to compromise the confidentiality, integrity, and...

The vulnerability of Lantronix XPort device servers lies in the lack of authenticity verification for a critical function. This allows attackers to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of Lantronix XPort devices lies in the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker to influence the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Marketing Administration component of the Oracle Marketing marketing platform allows a perpetrator to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of Oracle Marketing’s Marketing Administration component relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of data...

The vulnerability of the ZenCount visitor counter lies in the use of strictly encrypted user data, which allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ZenCount visitor counter is related to the use of strictly encrypted user data. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the ZenCount visitor counter lies in the lack of measures to neutralize special elements, allowing a violator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ZenCount visitor counter is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...