CVE-2026-3844

CVE-2026-3844 Mass Exploit CVE-2026-3844 – Breeze Cache WordPress =2.4.4 allows unauthenticated file upload via fetchgravatarfromremote when local gravatar hosting is enabled. Installation Download repository git clone https://github.com/im-hanzou/CVE-2026-3844 Go to repository folder cd...

Shadow-Vault

Shadow Vault 🔐 Shadow Vault 는 시스템 관리자 가 공유 호스팅 환경에서 shadow 파일에 새 사용자 자격 증명을 안전하게 추가할 수 있도록 설계된 경량 PHP 웹 도구입니다. 기존 shadow aging 형식을 자동으로 감지하고, SHA-512 비밀번호 해싱을 사용하며, 여러 쓰기 대체 방법을 지원하고, cPanel 웹메일포트 2096에 대한 원클릭 자동 로그인 까지 제공합니다. ⚠️ 고지 : 이 도구는 합법적인 서버 관리 전용 으로 제작되었습니다. 귀하가 소유하지 않은 시스템에 대한 무단 접근 또는 사용...

litespeed-cpanel-cve-2026-54420-fix

Kit de Mitigación CVE-2026-54420 Kit de remediación, auditoría y verificación defensiva para CVE-2026-54420 que afecta al LiteSpeed cPanel Plugin en entornos de hosting compartido que utilizan CloudLinux / CageFS. ⚠️ Aviso de Seguridad Este repositorio está destinado únicamente a administradores d...

ai-kubernetes-helm-chart-security

AI on Kubernetes: Helm chart security defaults evidence This repository holds the data and evidence behind the Sorami technical report "AI on Kubernetes: 10 of 14 Helm charts ship with no API auth" version 1.2. Read the report here: https://sorami.com.au/research/ai-kubernetes-helm-chart-security...

PT-2026-93254

Name of the Vulnerable Software and Affected Versions Acronis Backup plugin for cPanel & WHM Linux versions prior to 1.9.3.1021 Acronis Backup extension for Plesk Linux versions prior to 1.8.11.638 Acronis Backup plugin for DirectAdmin Linux versions prior to 1.2.3.238 Description Local privilege...

The vulnerability of the Easy Hosting Control Panel (EHCP) related to the lack of security measures for the website structure allows attackers to execute arbitrary code.

The vulnerability of the Easy Hosting Control Panel EHCP relates to the lack of measures taken to protect the structure of the web page when processing the “action” parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

allstar v4.6

Allstar !IMPORTANT The OpenSSF-hosted Allstar GitHub App has been retired. Allstar, the OpenSSF Scorecard subproject, itself continues to be maintained — you must now run it yourself, either as a GitHub Action or as a service daemon. See ossf/allstar881 for more details. If your organization was...

CVE-2026-5956

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...

CVE-2026-5956 SQLi in Ankara Hosting's Site Management Panel

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...

EUVD-2026-68508

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...

CVE-2026-5956

Ankara Hosting Site Management Panel is affected by a SQL injection vulnerability caused by improper neutralization of special elements used in an SQL command. The issue affects versions through 15062026 . The assigned CVSS 3.1 score is 8.8 (HIGH) , with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:...

CVE-2026-5956 SQLi in Ankara Hosting's Site Management Panel

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...

PT-2026-83798

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...

CVE-2026-5956: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...

Malicious code in ndmfguyhoxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15616 Malicious code in ndmxchdjxn2 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Next.js: Next.js: Denial of Service via Image Optimization API

A flaw was found in Next.js. When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. A remote attacker could exploit this by requesting large local assets from the /next/image endpoint...

Cross-site Scripting (XSS)

Overview org.webjars.npm:pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript...

GHSA-HQ66-CQWQ-W95J PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true which is the default value and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches Workarounds Set...

MAL-2026-12290 Malicious code in twork-data-services-customer-api-v2-customer-vip-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6182daf75450f1e553f81c3979a275c481690e27d04712285b85a25ebadc3b On require of this package, index.js loads platform.js which selects a platform-specific payload linuxx64/linuxarm64/darwin/win32, downloads an opaqu...