CVE-2026-21978

CVE-2026-21978 My CVE in Oracle FLEXCUBE Universal Banking Link: https://www.oracle.com/security-alerts/cpujan2026.html...

CVE-2025-14221

Description 1. CVE-2025-14221 2. Discoverer: Fatma Trabelsi 3. Vendor of Product: SourceCodester 4. Affected Product: Online Banking System 1.0 POC A Stored Cross-Site Scripting XSS vulnerability exists in the User Profile Update functionality of the application. The application fails to properly...

CVE-2025-29015

CVE-2025-29015 - Internet Banking System 2.0.0 Stored XSS in pagesaccount.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 via the name parameter in /admin/pagesaccount.php. Malicious JavaScript code can be injected and stored in t...

CVE-2024-56924

CVE-2024-56924 Vulnerability Description A Cross-Site Request Forgery CSRF vulnerability exists in the code astro Internet Banking System version 2.0.0, which allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as administrators, without their knowledge...

Exploiting-CVE-2021-44228-Log4Shell-in-a-Banking-Environment

Exploiting-CVE-2021-44228-Log4Shell-in-a-Banking-Environment Objective: Demonstrate the exploitation of the Log4Shell vulnerability CVE-2021-44228 within a simulated banking application environment. Scope: 1: Setup a vulnerable banking application using Apache Log4j. 2:Craft a payload to exploit...

vuln-bank

Vulnerable Bank Application 🏦 A deliberately vulnerable web application for practicing application security testing of Web, APIs and LLMs, secure code review and implementing security in CI/CD pipelines. ⚠️ WARNING: This application is intentionally vulnerable and should only be used for...

vuln-bank-mobile

💳 Vulnerable Bank Mobile App Vulnerable Bank is an intentionally insecure mobile application built for security engineers, penetration testers, and mobile app security learners to practice and demonstrate real-world exploitation of insecure coding practices. This mobile app acts as a frontend for...

CVE-2025-29018

CVE-2025-29018 - Internet Banking System 2.0.0 Stored XSS in pagesaddacctype.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 due to unsanitized input in the name parameter in pagesaddacctype.php. Attackers can store malicious...

Qakbot

This repository does not have a README...

EQGRP_Lost_in_Translation

EQGRP Lost in Translation Decrypted content of odd.tar.xz.gpg, swift.tar.xz.gpg and windows.tar.xz.gpg Downloaded from https://yadi.sk/d/NJqzpqo3GxZA4 Original post from the ShadowBrokers https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation windows : contains Windows exploits,...

CVE-2025-29017

CVE-2025-29017 - Internet Banking System 2.0.0 Remote Code Execution via Profile Picture Upload Description A Remote Code Execution RCE vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profilepic parameter within pagesviewclient.php...

zeek-gozi-detector

Gozi Malware Detector This Zeek packages detects Gozi banking malware activity. Resources: The RAR files this package looks for were discussed in the following articles: https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/...

WSO2 Open Banking AM input validation error vulnerability

The WSO2 Open Banking AM contains an input validation error vulnerability. This flaw arises because user input is accepted when constructing a redirect URL without performing the intended validation checks. As a result, open redirection may occur; attackers can exploit specially crafted URLs to...

Banks are blocking AI agents from customer accounts

This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bank’s rules. Bianco Research...

Banking-Management-System-XSS-Vulnerability

itsourcecode Banking Management System V1.0 - Reflected XSS Vu...

WSO2 Enterprise Integrator cross-site scripting vulnerability

WSO2 Enterprise Integrator versions prior to 6.6.0 and 6.6.0.204; WSO2 Identity Server versions prior to 5.10.0 and 5.10.0.310, 6.0.0 and 6.0.0.212, 6.1.0 and 6.1.0.195, and 7.0.0 and 7.0.0.64; WSO2 API Manager versions prior to 3.1.0 and 3.1.0.286, 3.2.0 and 3.2.0.376, 3.2.1 and 3.2.1.10, 4.0.0...

WSO2 API Manager side-channel information disclosure vulnerability

WSO2 API Manager versions prior to 3.1.0 through 3.1.0.310, 3.2.0 through 3.2.0.401, 3.2.1 through 3.2.1.26, 4.0.0 through 4.0.0.318, 4.1.0 through 4.1.0.180, 4.2.0 through 4.2.0.119, and 4.3.0 through 4.3.0.30; WSO2 Identity Server as Key Manager versions prior to 5.10.0 through 5.10.0.320; WSO2...

WSO2 Enterprise Integrator Authorization Issue Vulnerability

WSO2 Enterprise Integrator 6.6.0 to 6.6.0.204 before version; WSO2 Identity Server 5.10.0 to 5.10.0.286 before version, 5.11.0 to 5.11.0.344 before version, 6.0.0 to 6.0.0.188 before version, 6.1.0 to 6.1.0.150 before version, and 7.0.0 to 7.0.0.35 before version; WSO2 API Manager 3.1.0 to...

Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobi...

Malware in app-sca-info-banking

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...