CVE-2019-11932-SupportApp

CVE-2019-11932-SupportApp Este archivo de código nativo tiene como objetivo complementar el exploit de RCE de GIF de Whatsapp publicado por Awakened, calculando la dirección de la función system y la dirección del gadget ROP para diferentes tipos de dispositivos, las cuales pueden usarse luego pa...

inside-pegasus

Inside Pegasus: documentos clave de WhatsApp v. NSO Group Una selección de documentos internos del Grupo NSO, materiales de producto y testimonios jurados que entraron en el registro público en WhatsApp Inc. and Meta Platforms, Inc. v. NSO Group Technologies Limited and Q Cyber Technologies Limit...

CVE-2019-11932

CVE-2019-11932 La dirección de system y el gadget deben ser reemplazadas por la dirección real encontrada mediante una vulnerabilidad de divulgación de información. Después de reemplazar la dirección de system y el gadget. Ejecute el código para generar el archivo GIF corrupto: root@kitploit:...

CVE-2019-11932-whatsApp-exploit

CVE-2019-11932-whatsap-exploit La dirección de system y el gadget deben ser reemplazados por la dirección real encontrada mediante una vulnerabilidad de divulgación de información. Después de reemplazar la dirección de system y el gadget. Ejecuta el código para generar el archivo GIF corrupto:...

MAL-2026-15820 Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

guasap-whatsapp-foresincs-tool

Guasap Forensic Guasap Forensic implementado en Python bajo la Licencia Pública General de GNU, para la extracción y análisis de archivos, bases de datos y registros para la forense de WhatsApp. ¿Qué hace? 1. Verificar root en el dispositivo 2. Extraer BD y archivos multimedia sin root 3. Extraer...

whatsapp-mitd-mitm

WhatsApp MitD & MitM Introduction This repository contains PoC code and tools that were developed as part of our research 01 on remotely exploiting Man-in-the-Disk MitD vulnerabilities on WhatsApp for Android. As discussed in our blog post, the code and accompanying scripts found here, were used ...

WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android

Meta on Tuesday announced a set of WhatsApp account security features, including support for multiple passkeys to a single account to help users with both iOS and Android devices sign into their accounts using the phishing-resistant method. The tech giant said more than 1 billion people use a...

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. Thes...

Malicious code in ranux-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f package.json declares the dependency @whiskeysockets/baileys but resolves it from github:rcedubot/X instead of the npm registry. Installing ranux-dev...

CVE-2026-48494

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

CVE-2026-48483

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...

EUVD-2026-56780

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

CVE-2026-48494

Vulnerability summary: TypeBot (versions around 3.16.1) contains an authentication/authorization flaw in its WhatsApp preview workflow. An authenticated user with read access to any typebot can resume a WhatsApp preview webhook session belonging to a different typebot by combining an authorized t...

CVE-2026-48494 TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

CVE-2026-48494 TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...

EUVD-2026-56219

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...

CVE-2026-48483 TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...

CVE-2026-48483 TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...