DC30-Badge-Challenge-Writeup

DC30-Badge-Challenge-Writeup Table of Contents Intro Challenge Part 1: Gathering Notes Challenge Part 2: Calling YИИEႱ Challenge Part 2A: Alice Challenge Part 2B: Bob Challenge Part 2C: Carol Challenge Part 2D: Dan Challenge Part 2E: Eve Challenge Part 2F: Trevor Challenge Part 3: The Final Threa...

CVE-2026-113487

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against...

CVE-2026-113488

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

EUVD-2026-111726

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

EUVD-2026-111725

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against...

dc34-vault

DC34 vault Application !WARNING Loading your own firmware onto your badge will wipe the light encryption key and cause your badge to enter developer mode. NOTICE: this repo is now orphaned and will be archived soon, as it is now merged into xous-core. It only existed in the bunnie github reposito...

Overglade-Badges

Overglade Hackathon Badges These are zero-power hackathon badges I designed for the overglade hackathon in singapore! They're powered by the RP2040 and have passive NFC and an onboard e-ink driver! Custom Features Passive NFC tap for whatever your heart desires E-ink support so that you don't nee...

dcsgonebadge

DEF CON Singapore One Badge This project manages the hardware design of the Circuit Crafters first project, an electronic hardware badge intended for distribution at the DEF CON Singapore 2026 security conference at the Marina Bay Sands Expo and Convention Centre. License This project is licensed...

purpleteam

purpleteam CLI CLI component of purpleteam - Currently in alpha Installation Simplest npm install -g purpleteam If you want to debug Clone this repository. Configuration Copy the config/config.example.json to either config/config.local.json or config/config.cloud.json depending on which...

CVE-2025-61777

CVE-2025-61777 1. Unauthorized modification of badge templates on FlagforgeCTF CVE-2025-61777 Summary The Flagforge application https://flagforge.xyz exposes critical vulnerabilities in its administrative API endpoints, specifically /api/admin/badge-templates GET and...

gha-lab-232af4821f

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of BraveUX/for-the-badge at commit...

Malware in @drone-js-ext/vip-badge

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @drone-js-ext/vip-badge (npm)

Source: amazon-inspector 2f7afa65da63d3360d15659ebdcce5f5078fa7bd210e04c069f88834f0c1f75c The package is a zero-functionality stub whose main module index.js exports a Proxy returning no-op functions for any property access. Its only real behavior is a beacon implemented in beacon.cjs that collec...

Malicious code in @drone-js-ext/vip-badge (npm)

@drone-js-ext/vip-badge is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 0.0.1, 1.0.1, 2.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry...

MAL-2026-18277 Malicious code in @drone-js-ext/vip-badge (npm)

@drone-js-ext/vip-badge is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 0.0.1, 1.0.1, 2.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry...

CVE-2026-106161

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

EUVD-2026-102085

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

CVE-2026-106161 Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

CVE-2026-106161

Progress Kendo UI for jQuery releases from v2020.1.114 up to (but not including) v2026.3.1015 are vulnerable to Cross-Site Scripting (XSS) . The Badge text method fails to encode string values, rendering them as raw HTML even when supplied through text binding. An attacker capable of modifying bo...

CVE-2026-106161: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...