WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC" markers present in the...

CVE-2025-24813

Описание Данный репозиторий представляет собой среду для воспроизведения последней RCE-уязвимости CVE-2025-24813 в Tomcat. Только для обучения и исследований! Условия эксплуатации В приложении включена функция записи DefaultServlet, которая по умолчанию отключена Приложение поддерживает частичные...

CVE-2025-24813-POC

CVE-2025-24813: Apache Tomcat RCE 개념 증명 이 저장소는 CVE-2025-24813을 통해 Apache Tomcat의 원격 코드 실행RCE 취약점을 시연하기 위한 통제된 자동화 환경을 제공합니다. 개요 이 PoC는 Apache Tomcat의 DefaultServlet에서 잘못 구성된 파일 기반 세션 지속성을 악용하여 무단 파일 덮어쓰기를 수행합니다. 이 저장소 사용 방법 사전 요구 사항 Docker 및 Docker Compose가 설치되어 있어야 합니다. 1. 환경 실행 저장소 루트에서 다음을...

react-cve-2025-55182

react-cve-2025-55182 Это дамп вредоносного ПО и прочего подозрительного мусора, который я нашёл на сервере моего свадебного сайта после эксплуатации уязвимости выполнения кода при серверном рендеринге React. Это небольшой дроплет Digital Ocean, на котором работает довольно заурядное приложение на...

BIT-RABBITMQ-2026-67234 RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

java-vulnerable

Демо-потребитель для CVE-2016-0714 Tomcat session persistence RCE + CVE-2013-1814 Apache Rave UserApi info disclosure плюс четыре уязвимости Java OSS, связанные с filter-padding. context.xml включает PersistentManager → цепочка Tomcat ГОРЯЧА; applicationContext-security.xml ограничивает...

casper-shell

🦇 Casper@shell: - Продвинутая PHP веб-оболочка Casper@shell: — это улучшенная, более удобная версия оболочки p0wny с множеством новых функций. Эта версия создана для быстрого выполнения разведки, эксфильтрации или развертывания механизмов постоянства. ✨ Возможности 🖥️ Расширенный терминал Полная...

AZL-105348 CVE-2026-62146 affecting package cri-o 1.30.1-1

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

EUVD-2026-89789

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-62146

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-62146: Trust Boundary Violation

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

CVE-2026-101271 OAuth credentials not disabled when application is disabled

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-88805

In SUSE Rancher versions 2.15 before 2.15.2 , a vulnerability exists where incorrect credential cleaning occurs during the logout process. This flaw allows remote attackers to maintain access credentials even after an account has been logged out. The CVSS v3.1 score is 8.1 (HIGH) , indicating a h...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

BIT-AIRFLOW-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-100596

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host...

EUVD-2026-87455

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host...