CVE-2025-61777

CVE-2025-61777 1. Modificação não autorizada de modelos de emblemas no FlagforgeCTF CVE-2025-61777 Resumo A aplicação Flagforge https://flagforge.xyz expõe vulnerabilidades críticas em seus endpoints de API administrativa, especificamente /api/admin/badge-templates GET e...

DC30-Badge-Challenge-Writeup

DC30-Badge-Challenge-Writeup Table of Contents はじめに チャレンジパート1: メモの収集 チャレンジパート2: YИИEႱに電話する チャレンジパート2A: アリス チャレンジパート2B: ボブ チャレンジパート2C: キャロル チャレンジパート2D: ダン チャレンジパート2E: イブ チャレンジパート2F: トレバー チャレンジパート3: 最後のスレッド カンファレンスで電話を逃した場合は? 余談 はじめに こんにちは! ピート別名 Kybrです。これは DEF CON 30 バッジチャレンジの writeup です。...

Overglade-Badges

Badge dell'Hackathon Overglade Questi sono badge hackathon a zero consumo che ho progettato per l'hackathon Overglade a Singapore! Sono alimentati dall'RP2040 e dispongono di NFC passivo e un driver e-ink integrato! Caratteristiche Personalizzate Tocco NFC passivo per qualsiasi cosa tu desideri...

dcsgonebadge

DEF CON Singapore One Badge Questo progetto gestisce il design hardware del primo progetto di Circuit Crafters, un badge elettronico destinato alla distribuzione al DEF CON Singapore 2026 security conference presso il Marina Bay Sands Expo and Convention Centre. Licenza Questo progetto è concesso...

purpleteam

purpleteam CLI CLI-Komponente von purpleteam - Derzeit in Alpha Installation Einfachste npm install -g purpleteam...

EUVD-2026-66418

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-18501

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

EUVD-2026-53926

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-18501 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-18501 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-18501

The CVE concerns the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress. It is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69, caused by insufficient input sanitizati...

MAL-2026-13282 Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...

MAL-2026-12864 Malicious code in bnpl-blocks-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57d88037b98733cb7376fa7fa11e80d1d6eb6f9373a7d6e1b555e96039b3abe On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from one of three obfuscated...

CVE-2026-7436

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-7436 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-53987

GLPI 11 before 2.14.4 is affected by a stored XSS in the Tag plugin's Kanban badge rendering. The Tag plugin stores tag names without HTML sanitization and injects them into Kanban badges via PluginTagTag::preKanbanContent(), without escaping output. An authenticated user with TAG MANAGEMENT crea...

CVE-2026-53987 GLPI 11 before 2.14.4 Tag Plugin Stored Cross-Site Scripting in Kanban Badge Rendering

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update right...

EUVD-2026-42614

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update right...

CVE-2026-12435 Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-40935

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...