Adamantium-Thief

🔓 Adamantium-Thief Get chromium based browsers: passwords, credit cards, history, cookies, bookmarks, autofill. Chrome 80 is supported! Need firefox passwords decryptor? 🌿 Examples: 🔑 Get passwords from browsers: Stealer.exe PASSWORDS 💳 Get credit cards from browsers: Stealer.exe CREDITCARDS 🕘 Ge...

chromepass

Chromepass - Hackeando contraseñas y cookies guardadas de Chrome Ver demo · Reportar error · Solicitar función Tabla de contenido Acerca del proyecto Detección AV Primeros pasos Requisitos previos Instalación Uso Correo electrónico Errores, fallos y solicitudes de funciones Más información Licenc...

CVE-2026-64946 CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946

The Pandora FMS monitoring platform is affected by a chained vulnerability involving CSRF and unrestricted SVG file upload within the File Manager module . This flaw allows for stored Cross-Site Scripting (XSS) , which can be leveraged to exfiltrate session cookies and perform administrator accou...

EUVD-2026-90593

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-64946: Improper Neutralization of Input During Web Page Generation

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...

Malicious code in my-ctf-helper-script-9921 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409 On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL...

MAL-2026-16332 Malicious code in feed-widget-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9c3f4f4751b0adffb78a311ee048162a853729a5dd1d0826593f394a4d663e2 On load, index.js schedules a setTimeout 2s that fetches the current origin's /profile endpoint, parses the returned HTML, extracts a.flag-value...

Malicious code in npmscript_tesstalert_unpkg (npm)

Source: amazon-inspector 5fa1adfe349e0a6092589e90bf38184b5769148bf42b4216fc714ad446ea747b The package ships a single browser JavaScript file declared as both main and unpkg, so any page embedding the package via the unpkg CDN loads this script. The script calls alert11 and then executes...

MAL-2026-16347 Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

Malicious code in pulse-pwn-9f3a2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8086e23ce4b6ff1ca043ca8d9c83f384455e0baee3d06cd79e8a0d5d52c04e1 index.js contains top-level code that fetches /profile and sends document.cookie together with the response body to a hardcoded webhook.site URL...

Exploit for CVE-2026-36392

CVE-2026-36392: Stored XSS in RISE CRM Item Title Field Su...

MAL-2026-15937 Malicious code in minecraftmodes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2057275d7d6bc39e22d9147702d20b43fcabcab4e438821e823010937448eb6c The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the authorize.html process. An attacker can execute arbitrary JavaScript in a user's browser by tricking the user into visiting a specially crafted URL, which can result in the exfiltration of session tokens...

Malicious code in cat-embed-i18n-res (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c612800e80bb36720e75741be9665ab6acbed58bcd5d51065fcedd1d990aaad0 The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are HTML/JavaScript XSS payloads...

MAL-2026-14471 Malicious code in cat-embed-i18n-res (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c612800e80bb36720e75741be9665ab6acbed58bcd5d51065fcedd1d990aaad0 The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are HTML/JavaScript XSS payloads...

CVE-2026-49436 LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

Malicious code in the-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f7901c35765e01f25defe0c4d489b8f320340b45968e89b9dafe5821b7561fd The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-creat...

MAL-2026-12810 Malicious code in the-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f7901c35765e01f25defe0c4d489b8f320340b45968e89b9dafe5821b7561fd The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-creat...

Malicious code in react-fontawesome-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4706d295cdd6ae07918ab25d54475d97d88e92c8ba2d3923078ba916096b4366 The default-exported React component in [email protected] performs an unconditional axios GET to http://command.control on every render a...