CVE-2025-66431

CVE-2025-66431 affects WebPros Plesk on Linux, prior to 18.0.73.5 and before 18.0.74.2 in the 18.x branch. Flaw in the domain creation mechanism allows remote authenticated users to execute arbitrary code as root when they have Create and manage sites with Domains management and Subdomains manage...

PT-2025-47576

🎯 Real scan results: 11 subdomains → 4m 35s ✅ Found nginx/1.18.0 🔴 Detected CVE-2021-4567 HIGH 🤖 AI provided patch + remediation All automatic. All local. All free. This is recon in 2025 👀 bugbountytips cve appsec...

EUVD-2021-1177

Malware in sbrugna...

EUVD-2020-18736

Malware in sbrugna...

EUVD-2017-9514

Malware in sbrugna...

EUVD-2016-7541

Malware in sbrugna...

EUVD-2025-25497

Malicious code in bioql PyPI...

EUVD-2023-0281

Malicious code in bioql PyPI...

EUVD-2023-53113

Malicious code in bioql PyPI...

EUVD-2024-0861

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2019-11711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperativel...

CVE-2023-33293

An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on .localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-deamon to determine if a given app is installed and read th...

CVE-2020-26106

cPanel before 88.0.3 has weak permissions world readable for the proxy subdomains log file SEC-558...

Robust LLM Fingerprinting Via Domain-Specific Watermarks

As open-source language models OSMs grow more capable and are widely shared and finetuned, ensuring model provenance, i.e., identifying the origin of a given model instance, has become an increasingly important issue. At the same time, existing backdoor-based model fingerprinting techniques often...

python-werkzeug: cookie prefixed with = can shadow unprefixed cookie

A flaw was found in python-werkzeug. Browsers may allow "nameless" cookies like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie for another subdomain. If a Werkzeug application is running next to a...

CipherBank: Exploring the Boundary of LLM Reasoning Capabilities through Cryptography Challenges

Large language models LLMs have demonstrated remarkable capabilities, especially the recent advancements in reasoning, such as o1 and o3, pushing the boundaries of AI. Despite these impressive achievements in mathematics and coding, the reasoning abilities of LLMs in domains requiring cryptograph...

GHSA-HG9J-64WP-M9PX Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Summary A session hijacking vulnerability exists when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement for applications hosted on sibling subdomains e.g.,...

Flarum 注入漏洞

Flarum is a simple forum software for building communities from Flarum open source. An injection vulnerability exists in Flarum versions prior to 1.8.10, which stems from an attacker-controlled subdomain being able to set a parent domain's cookie, leading to session hijacking...

Linux Distros Unpatched Vulnerability : CVE-2024-28233

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS...

CVE-2024-28233

JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API...