⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More

This week made one thing clear: small oversights can spiral fast. Tools meant to save time and reduce friction turned into easy entry points once basic safeguards were ignored. Attackers didn't need novel tricks. They used what was already exposed and moved in without resistance. Scale amplified...

n8n Node.js Package 1.65.0 < 1.121.0 Improper Access Control (Ni8Mare)

The version of the n8n Node.js Package installed on the remote host is prior to 1.121.0. It is, therefore, affected by an improper access control vulnerability: - A vulnerability in n8n allows an attacker to access files on the underlying server through execution of certain form-based workflows. ...

Vulnerability fixed in n8n

N8n has fixed a vulnerability in versions below 1.121.0. The vulnerability in allows unauthorized external malicious parties to access files on the underlying server via specific, form-based workflows. This could expose sensitive information stored on the system and, depending on the configuratio...

n8n 输入验证错误漏洞

n8n is a scalable workflow automation tool from the n8n open source. An input validation error vulnerability exists in versions prior to n8n 1.121.0, which stems from an attacker being able to access underlying server files by executing a form-based workflow, potentially leading to the disclosure...

security-guide-for-developers

This is a security guide for web developers, covering various security topics such as authentication, authorization, data validation, and encryption. The guide is divided into several sections, including a security checklist, authentication and authorization, data validation and sanitation, and...

PYSEC-2025-12

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions,including but not...

CVE-2024-53829 Cross-Site Request Forgery in CodeChecker API

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions, including but not...

[SECURITY] Fedora 37 Update: curl-7.85.0-10.fc37

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

WordPress Force Images Download 1.8 CSRF / SSRF

Exploit Author : Etharus Vulnerability : Cross Site Request Forgery to Server Side Request Forgery Impact : internal ip disclosure , file extension bypass, internal port scan. Product Vendor : Nazakat Ali Version Tested : 1.8 Date : 14/07/2023 Fofa Dork :...

DEBIAN-CVE-2020-27304

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mghandleformrequest API. Web applications that use the file upload form handler, and use parts of the user-controlled...

Fedora: Security Advisory for curl (FEDORA-2021-eb5b7c53a9)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for curl (FEDORA-2020-6af1dd2936)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Formphish - Auto Phishing Form-Based Websites

Auto Phishing form-based websites. This tool can automatically detect inputs on html form-based websites to create a phishing page. Features: Auto detect device Port Forwarding by Ngrok IP Tracker Legal disclaimer: Usage of Formphish for attacking targets without prior mutual consent is illegal...

[SECURITY] Fedora 29 Update: curl-7.61.1-12.fc29

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Password Field With Auto-Complete

In typical form-based web applications, it is common practice for developers to allow autocomplete within the HTML form to improve the usability of the page. With autocomplete enabled default, the browser is allowed to cache previously entered form values. For legitimate purposes, this allows the...

Dell SonicWALL Secure Mobile Access SMA 8.1 - Cross-Site Scripting / Cross-Site Request Forgery

Dell SonicWALL Secure Mobile Access SMA 8.1 XSS And WAF CSRF Vendor: Dell Inc. Product web page: https://www.sonicwall.com/products/secure-mobile-access/ Affected version: 8.1 SSL-VPN Summary: Keep up with the demands of today’s remote workforce. Enable secure mobile access to critical apps and...

How to Force Enterprise Manager Login to Use Form-Based Authentication

Article Applicability This article applies to Veeam Backup & Replication 12.x and older, as in those versions, the default was for Veeam Backup Enterprise Manager to utilize a Windows Authentication pop-up key="useWindowsAuth" value="true". Starting in Veeam Backup Enterprise Manager v13, the...

KLA10752 Denial of service vulnerability in Microsoft Acrtive Directory Federation Services

Lack of input data checks was found in Microsoft Active Directory Federation Services. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited remotely via a specially designed input to form-based authentication. Original advisories...

Fiyo CMS 2.0_1.9.1 - SQL Injection

Exploit Title: Fiyo CMS multiple SQL vulnerability Date: 2015-06-28 Exploit Author: cfreer poc-lab Vendor Homepage: http://www.fiyo.org/ Software Link: http://tcpdiag.dl.sourceforge.net/project/fiyo-cms/Fiyo%202.0/fiyocms2.0.2.zip Version: 2.01.9.1 Tested on: Apache/2.4.7 Win32 CVE : CVE-2015-393...

Ruby Web Applications Vulnerability Scanner: Yasuo

Ruby Web Applications Vulnerability Scanner Yasuo is a ruby script that scans for vulnerable 3rd-party web applications While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us ...