portswigger-labs-writeups

portswigger-labs-writeups Complete writeups for P...

Cracking IoT Security: Can LLMs Outsmart Static Analysis Tools?

Smart home IoT platforms such as openHAB rely on Trigger Action Condition TAC rules to automate device behavior, but the interplay among these rules can give rise to interaction threats, unintended or unsafe behaviors emerging from implicit dependencies, conflicting triggers, or overlapping...

Dnsmasq: undisclosed vulnerability (ZAI-2026-IKAE98)

Not disclosed. Details are not yet publicly disclosed...

SQLite report about CVE-2026-51296CVE-2026-51297CVE-2026-51300CVE-2026-51302CVE-2026-51303CVE-2026-51304

These are unreproducible. They appear to be AI hallucinations. See the analysis at JFrog.com...

From Consensus to Chaos: A Vulnerability Assessment of the RAFT Algorithm

In recent decades, the RAFT distributed consensus algorithm has become a main pillar of the distributed systems ecosystem, ensuring data consistency and fault tolerance across multiple nodes. Although the fact that RAFT is well known for its simplicity, reliability, and efficiency, its security...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992791)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992791 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer check in astvhubinitdev The variable d-name, returned by...

CellSecInspector: Safeguarding Cellular Networks Via Automated Security Analysis on Specifications

The complexity, interdependence, and rapid evolution of 3GPP specifications present fundamental challenges for ensuring the security of modern cellular networks. Manual reviews and existing automated approaches, which often depend on rule-based parsing or small sets of manually crafted security...

CVEhunter-Tools

CVEhunter: Integrated AI-Assisted Code Auditing Toolkit Windo...

Exploit for CVE-2025-14847

🌊 MongoDeepDive Context-Aware MongoDB Wire Protocol Explo...

Malicious code in kcheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 660a47461992421159d386fb5e8ce14c3c794e8059b276d4de539ca2235d8780 The package kcheck was found to contain malicious code. Source: ghsa-malware 9666f7f55b90b84ee1e458016ed3eb475f26465bcf2d4fbe690a142c3a53e311 Any...

Malicious code in intl-tel-input-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffcf244ee511453d176367146c8b6b5ee74d18e3037210dd63d19712c8647991 The package intl-tel-input-utils was found to contain malicious code. Source: ghsa-malware...

CVE-2025-15173

A weakness has been identified in SohuTV CacheCloud up to 3.2.0. Affected is the function advancedAnalysis of the file src/main/java/com/sohu/cache/web/controller/InstanceController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit...

CVE-2025-15173

CVE-2025-15173 affects SohuTV CacheCloud up to version 3.2.0. The vulnerability occurs in the advancedAnalysis function of src/main/java/com/sohu/cache/web/controller/InstanceController.java, enabling remote cross-site scripting. Reports indicate the exploit is publicly available. The public advi...

CVE-2025-15173 SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting

A weakness has been identified in SohuTV CacheCloud up to 3.2.0. Affected is the function advancedAnalysis of the file src/main/java/com/sohu/cache/web/controller/InstanceController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit...

CacheCloud code injection vulnerability

CacheCloud is a Redis cloud management platform open-sourced by SohuTV. A code injection vulnerability exists in CacheCloud 3.2.0 and earlier versions, which stems from a misuse of the function advancedAnalysis in the file src/main/java/com/sohu/cache/web/controller/InstanceController.java. This...

IBM Integrated Analytics System File Upload

The vulnerability of the IBM Integrated Analytics System, a unified data analysis system, lies in its ability to allow unlimited loading of dangerous types of files. Exploiting this vulnerability could enable a malicious actor to load any desired files remotely...

Securing the AI Supply Chain: What Can We Learn from Developer-Reported Security Issues and Solutions of AI Projects?

The rapid growth of Artificial Intelligence AI models and applications has led to an increasingly complex security landscape. Developers of AI projects must contend not only with traditional software supply chain issues but also with novel, AI-specific security threats. However, little is known...

VIPSQLi

🔥 VIP SQLi Scanner - Professional Triage Tool REAL SQLi PEH...

MAL-2025-192952 Malicious code in eslint-config-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e71714baca3a4619a8482f00c00fbed0efcca855796a70e740d4f53a3f807003 The package eslint-config-sdk was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ugc-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffd0991cb1cc7098930838b404210022aa2667d78f2884417f449d85e90fb12 The package ugc-kit was found to contain malicious code. Source: ghsa-malware 4e44ecda4e96910709480e50046146e482992e36fb2e8429211e1f653376d123 Any...