Webapp_Pentast

CVE-2022-31147 Proof of Concept & Manual Testing Guide This guide provides comprehensive methodologies for testing CVE-2022-31147, a critical path traversal vulnerability affecting the widely used matthiasmullie/minify library. The vulnerability allows attackers to exploit insufficient input...

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

W3 Total Cache WordPress plugin = 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename. id: CVE-2026-9282 info: name: W3 Total Cache =...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

CVE-2018-18572

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:16+00:00| seen| https://t.me/hackingAttack/27119 2026-09-01 20:02:17+00:00| seen|...

Malicious code in postcss-selector-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fec62079856815ded46ba283769d3d3e0d20e08b6196b8698e08e2df6677ee Package is published as postcss-selector-minify a word-order permutation of cssnano's widely used postcss-minify-selectors and registers itself to...

MAL-2026-10614 Malicious code in postcss-selector-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92fec62079856815ded46ba283769d3d3e0d20e08b6196b8698e08e2df6677ee Package is published as postcss-selector-minify a word-order permutation of cssnano's widely used postcss-minify-selectors and registers itself to...

CVE-2026-10551 Breeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify Library

The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting XSS due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the fina...

CVE-2026-10551

The Breeze Cache WordPress plugin (before version 2.5.6) is vulnerable to unauthenticated Stored XSS due to a predictable replacement hash in the HTML minification process and a related regex misusage. An attacker can inject arbitrary HTML attributes into the final HTML by predicting the placehol...

EUVD-2026-43164

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-9282 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-56018

A flaw was found in JavaScript::Minifier::XS. Repeated calls to the minify function can lead to a memory leak, causing unbounded memory growth. This can result in the affected process consuming all available memory, leading to its termination and a Denial of Service DoS for users of the component...

ALPINE-CVE-2026-56017

JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString XS.xs inspects the previous token's last byte to choose between a regexp literal and a...

CVE-2026-56018 JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify, allowing unbounded memory growth. In JsMinify XS.xs the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes withou...

CVE-2026-56018

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify, allowing unbounded memory growth. In JsMinify XS.xs the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes withou...

CVE-2026-56017

JavaScript::Minifier::XS (Perl) is affected in versions before 0.16. The vulnerability arises when the first meaningful token is a slash; the JsTokenizeString logic examines the previous token and, with no valid preceding token, dereferences a NULL pointer, causing a crash. The public minify() AP...

CVE-2026-13593 CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away

CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minify function has a memory leak when processing a document containing only characters to be removed, such as comments and whitespace...

PT-2026-53732

Name of the Vulnerable Software and Affected Versions JavaScript::Minifier::XS versions prior to 0.16 Description A NULL pointer dereference occurs when the first meaningful token of the input is a slash. The issue resides in the JsTokenizeString function within the XS.xs file, where the regexp...

Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT

Cybersecurity researchers have discovered a set of malicious npm packages that are designed to deliver a Windows-based remote access trojan RAT. The list of identified packages, is below - aes-decode-runner-pro 145 downloads postcss-minify-selector 256 downloads postcss-minify-selector-parser 615...

MAL-2026-5837 Malicious code in postcss-minify-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bc7341d6762a6209e4bde3d99f31f1a8650b6971e64a19547b9f35e7a51abb3 Package is published as postcss-minify-selector singular but its internal postcss plugin identifier is postcss-minify-selectors plural — the canonica...

Malicious code in postcss-minify-selector-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f5cbb74f4dd4b4770e8c9cc1a8aac88a4450cb01dbc0fa5242c42e343f54c The package name impersonates the widely-used postcss-selector-parser library which it also declares as a dependency and re-exports verbatim from...