CVE-2012-1723

वेब ब्राउज़र ड्राइव-बाय जो CVE-2012-1723 का उपयोग करके दूरस्थ कोड निष्पादन करता है। एक वॉक-थ्रू और तकनीकी विवरण निम्नलिखित पर पाया जा सकता है https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

CVE-2018-4878

लेखक और क्रेडिट्स लेखक: Vincent Yiu @vysecurity श्रेय: @evi1cg: मेरी मदद करने और मुझे प्रेरित रखने के लिए @smgoreli: मूल Calc.exe PoC @kbandla: वह जानता है, और मैं जानता हूँ। ; अस्वीकरण अधिक Aggressor स्क्रिप्ट विकास को प्रोत्साहित करने के लिए विकसित किया गया। केवल अधिकृत पैठ परीक्षण में उपयोग...

WebFEET

Externes Webfilter-Enumerationstool WebFEET WebFEET Von NCC Group Plc als Open Source veröffentlicht - http://www.nccgroup.com/ Entwickelt von Ben Williams https://github.com/nccgroup/webfeet Veröffentlicht unter AGPL, siehe LICENSE für weitere Informationen WebFEET ist eine Webanwendung zur...

PyStegosploit

PyStegosploit - Consegna di Exploit tramite Steganografia e Poliglotti video1 | video2 | page di Charmve - yidazhang1 at gmaildotcom, @Charmve @therealsaumil @amichael Maggio 2021 Stegosploit crea un nuovo modo per codificare exploit browser "drive-by" e consegnarli attraverso file immagine. Ques...

js-driveby-download-CVE-2006-4777

js-driveby-download-CVE-2006-4777 malware lato client di sfruttamento della vulnerabilità di Internet Explorer 6.0 SP1 su Windows XP SP2. Non richiede il consenso dell'utente e non scarica alcun file. Iniezione di Shell Code nella RAM da JavaScript con IE su Windows XP. Fileless, drive-by-downloa...

Malicious code in @demopack/www (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer

Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. The activity has been codenamed VEILDROP by Securonix. It's suspected that the initial payloads are distributed...

CVE-2026-56277 Flowise - Hardcoded CORS Wildcard in TTS Endpoint

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard on its text-to-speech TTS generation endpoint packages/server/src/controllers/text-to-speech/index.ts, independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS...

coruna

iOS Orchestrator — Coruna Web server, C2 listener, and intera...

System-Exploitation-Compromising

💀 System Exploitation & Compromising CAP 6135 – Cyber Lab...

chrome-148-exploit-poc

World Fun Zone - 2026 Security Research Framework Conferen...

CVE-2026-28792

Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration Access-Control-Allow-Origin: with the path traversal vulnerability previously reported to enable a browser-based drive-by attack. A remote attacker can enumerate the...

A DarkSword hangs over unpatched iPhones

Researchers at Google have identified an iOS exploit chain, named DarkSword, that has been used since late last year by multiple actors to infect iPhones with malware in targeted attacks. DarkSword combines six vulnerabilities in iOS and Safari to deploy malware on the device. It demonstrates, on...

EUVD-2026-11611

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS...

CVE-2026-28792

Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration Access-Control-Allow-Origin: with the path traversal vulnerability previously reported to enable a browser-based drive-by attack. A remote attacker can enumerate the...

CVE-2026-28792 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration Access-Control-Allow-Origin: with the path traversal vulnerability previously reported to enable a browser-based drive-by attack. A remote attacker can enumerate the...

CVE-2026-28792

Technical details (affected components, root cause, exploit data, or remediation specifics) are not provided in the connected documents. Monitor for updates.

PT-2026-25012

Summary The TinaCMS CLI dev server combines a permissive CORS configuration Access-Control-Allow-Origin: with the path traversal vulnerability previously reported to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary...