348 matches found
CVE-2018-7935
CVE-2018-7935 POC grab vaild Session first curl http://192.168.8.1/html/index.html | grep SessionID Instructions: Edit exploit.py , insert grabbed SessionID Vulnerability Status : Acknowledgemnt Recieved & Patch is released...
MAL-2026-17375 Malicious code in @revizahoshii/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
CVE-2026-107120
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...
CVE-2026-107120 Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...
CVE-2021-43857
CVE-2021-43857 CVE-2021-43857 Gerapy command execution Disclaimer This script is for learning and reference only. Do not maliciously attack other people's websites. If you violate laws or regulations, all consequences shall be borne by the user. Technology is innocent and has nothing to do with t...
MAL-2026-17346 Malicious code in @bellaxchuu/privatebails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17400 Malicious code in my-baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @lendxntaa/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @ikyyjee/ikyysingle (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
CVE-2026-96404 Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
EUVD-2026-93923
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
MAL-2026-17363 Malicious code in @kxa/xbails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
PT-2026-107225
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALL LOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying it...
Malicious code in @bellaxchuu/crystalred (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @bellaxchuu/teambails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17373 Malicious code in @queenanya/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
PT-2026-102645
šØ CVE-2026-102630 UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect...
CVE-2026-102630: Use of Less Trusted Source
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...
EUVD-2026-86451
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another clie...
CVE-2026-77967 Botslab G980H Dashcams Authentication Bypass by Capture-replay
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another clie...