56 matches found
Metaphor
Metaphor Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Twitter: https://twitter.com/HighByte Metaphor's source code is now released! The source include a PoC that generat...
CVE-2026-119493
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71...
EUVD-2026-119109
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71...
EUVD-2026-83942
Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...
PT-2026-96122
Name of the Vulnerable Software and Affected Versions Metaphor Creations Ditty ditty-news-ticker versions prior to 3.1.70 Description A stored cross-site scripting issue allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements. This occurs because the...
CVE-2026-93339: Improper Neutralization of Input During Web Page Generation
Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...
AIs as Modern Genies
This essay was written with Barath Raghavan, and originally appeared inLawfare. In April, an artificial intelligence AI agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its backups. In July, OpenAI aske...
You have to invite them in
Welcome to this week's edition of the Threat Source newsletter. I found myself watching the Oscars ceremony in its entirety for the first time in a few years. I'm in the U.K., so I watched it the following day. With next week's Year in Review launch looming and several pieces of content still to...
CVE-2025-23816
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in metaphorcreations Metaphor Widgets allows Stored XSS. This issue affects Metaphor Widgets: from n/a through 2.4...
EUVD-2023-51862
Malicious code in bioql PyPI...
EUVD-2024-30371
Malicious code in bioql PyPI...
EUVD-2025-3446
Malicious code in bioql PyPI...
EUVD-2023-53743
Malicious code in bioql PyPI...
EUVD-2023-27957
Malicious code in bioql PyPI...
State-Of-The-Art in Software Security Visualization: a Systematic Review
Software security visualization is an interdisciplinary field that combines the technical complexity of cybersecurity, including threat intelligence and compliance monitoring, with visual analytics, transforming complex security data into easily digestible visual formats. As software systems get...
Exploit for Path Traversal in Thecartpress Thecartpress_Ecommerce_Shopping_Cart
This is a PoC exploit for CVE-2015-3301, a vulnerability in the Stagefright media library that allows for remote code execution on Android devices. The exploit, called Metaphor, is designed to bypass Address Space Layout Randomization ASLR and execute arbitrary code on the device. The exploit...
CVE-2025-24736
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through = 2.35...
CVE-2024-32569
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31...
CVE-2023-23874
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Metaphor Creations Ditty plugin = 3.0.32 versions...
CVE-2023-49835
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through 2.31...