1C-Bitrix Before and After Photos Code Execution

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

WhatsApp-OSINT

WHATS OSINT 🕵️‍♂️ OSINT tool for WhatsApp that allows you to obtain profile photos, verify Business accounts, check status and user information, analyze linked devices, review privacy settings, and access full data using the WhatsApp OSINT API from RapidAPI. Supports 6 endpoints: about, base64,...

CVE-2026-72550-poc

CVE-2026-72550 — Friendica Unauthenticated SQL Injection Unauthenticated stacked-query SQL injection in the photos endpoint in Friendica allows any visitor to run arbitrary SQL. Field| Value ---|--- CVE ID| CVE-2026-72550 Product| Friendica self-hosted federated social network Affected| =...

CVE-2024-6132

CVE-2024-6132 Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload Usage usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | BY NXPLOIT - KHALED ALENAZI...

CVE-2026-112676

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access a user's Photos Library...

EUVD-2026-110403

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access a user's Photos Library...

CVE-2026-112676

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access a user's Photos Library...

CVE-2026-112676

This vulnerability affects various Apple operating systems , including iOS , iPadOS , macOS , and visionOS . Due to a lack of sufficient entitlement checks, an application may be able to gain unauthorized access to a user's Photos Library . The issue has been addressed in the following versions: ...

CVE-2026-116210

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that...

CVE-2026-116212

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in...

CVE-2026-116212 Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in...

CVE-2026-116210 Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that...

EUVD-2026-109804

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in...

EUVD-2026-109803

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that...

CVE-2026-116210 Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that...

CVE-2026-116212

The Webasyst Framework (through version 4.4.0 ) contains a stored cross-site scripting (XSS) vulnerability within the Photos app . Authenticated backend users with album edit rights can inject malicious JavaScript by providing a crafted value in the album url parameter. This input is stored and s...

CVE-2026-116212 Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in...

CVE-2026-116210

The Webasyst Framework (through version 4.4.0 ) contains a cross-site request forgery (CSRF) vulnerability in its Photos app . The root cause is that the app fails to enable the framework's opt-in CSRF check. This allows remote attackers to lure authenticated users to a malicious page that submit...

AI Halloween videos: Who’s getting your photos?

.kadence-column4801654ecc5f-ac .kt-inside-inner-colpadding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;.kadence-column4801654ecc5f-ac .kt-inside-inner-colcolumn-gap:var--global-kb-gap-sm, 1rem;.kadence-column4801654ecc5f-ac...