CVE-2026-62347

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call SPA logs the password URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore...

CVE-2026-62347

The Element Call native Matrix video conferencing application (versions 0.16.0 through 0.20.3 ) is vulnerable to sensitive information disclosure. The standalone SPA component logs the password URL query parameter; if a user submits an error report (rageshake ), these logs are shared with the app...

EUVD-2026-114519

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call SPA logs the password URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore...

CVE-2026-62347 Element Call exposes shared passwords in logs

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call SPA logs the password URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore...

CVE-2023-43149

CVE-2023-43149 Author : Aitor Herrero Fuentes Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/admin Version: 1.9.0.3 Tested on: Windows 10 Pro CSRF ADD ROOT ACCOUNT Cross Site Request Forgery vulnerability in application demo.spa-cart.com allows a...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

CVE-2023-43148

CVE-2023-43148 Author : Aitor Herrero Fuentes Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/admin Version: 1.9.0.3 Tested on: Windows 10 Pro CSRF DELETE ALL ACCOUNT Cross Site Request Forgery vulnerability in application demo.spa-cart.com allows ...

DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-

Welcome to React Router! A modern, production-ready template for building full-stack React applications using React Router. Features 🚀 Server-side rendering ⚡️ Hot Module Replacement HMR 📦 Asset bundling and optimization 🔄 Data loading and mutations 🔒 TypeScript by default 🎉 TailwindCSS for stylin...

wix-kickstartx-challenge-writeup

Wix KickstartX Challenge 2026 — Full Writeup Result: 200/200 100% — Token: WKX-9245FA70-200 Date: March 24, 2026 1. Discovery & Reconnaissance The Challenge Announcement A LinkedIn post announced a special challenge for Wix KickstartX — a junior developer program. The rules: 30 minutes, one...

domdig

DOMDig DOMDig es un escáner de DOM XSS que se ejecuta dentro del navegador web Chromium y puede escanear aplicaciones de página única SPA de forma recursiva. A diferencia de otros escáneres, DOMDig puede rastrear cualquier aplicación web incluyendo gmail manteniendo un registro de las...

htcap

HTCAP htcap es un escáner de aplicaciones web capaz de rastrear aplicaciones de una sola página SPA de forma recursiva interceptando llamadas ajax y cambios en el DOM. CARACTERÍSTICAS PRINCIPALES Motor de rastreo DOM recursivo Descubre solicitudes ajax/fetch/jsonp/websocket Soporta cookies, proxy...

Malware in @galicia-toolkit/spa-build-config

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17690 Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

Malicious Package

Overview @galicia-toolkit/spa-build-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

PYSEC-2026-4041 djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

PT-2026-105798

Impact djust's per-object authorization get object + has object permission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA url change navigation, and c % live render % embedded child views. An...

AlmaLinux 9.2 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778297730)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778297730 advisory. - In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malforme...