cookie-monster

Cookie-Monster-BOF Steal browser cookies for edge, chrome and firefox through a BOF! Cookie Monster BOF will extract the WebKit Master Key and the App Bound Encryption Key for both Edge and Chrome, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and th...

Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export

The Event Monster Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

@fdm-monster/server (>=2.0.11, <=2.1.1), @objectif-lune/node-red-contrib-ftp (>=1.1.0, <=1.2.0) +2 more potentially affected by CVE-2026-102990 via basic-ftp (>=6.0.1, <=6.2.0)

basic-ftp NPM version =6.0.1, =2.0.11, =1.1.0, =1.0.0, =2.0.3-beta, =2.1.4-1257-beta.1 Source cves: CVE-2026-102990 Source advisory: OSV:GHSA-C475-QRG2-PJ4R...

@fdm-monster/server (>=2.0.11, <=2.1.1), @objectif-lune/node-red-contrib-ftp (>=1.1.0, <=1.2.0) +2 more potentially affected by CVE-2026-102990 via basic-ftp (>=6.0.1, <=6.2.0)

basic-ftp NPM version =6.0.1, =2.0.11, =1.1.0, =1.0.0, =2.0.3-beta, =2.1.4-1257-beta.1 Source cves: CVE-2026-102990 Source advisory: GHSA-C475-QRG2-PJ4R...

@fdm-monster/server (>=2.0.11, <=2.1.1), @objectif-lune/node-red-contrib-ftp (>=1.1.0, <=1.2.0) +2 more potentially affected by CVE-2026-102990 via basic-ftp (>=6.0.1, <=6.2.0)

basic-ftp NPM version =6.0.1, =2.0.11, =1.1.0, =1.0.0, =2.0.3-beta, =2.1.4-1257-beta.1 Source cves: CVE-2026-102990 Source advisory: MEND:CVE-2026-102990...

CVE-2026-81201

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

EUVD-2026-69997

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201

The Drupal Monster Menus module (versions 0.0.0 through 9.5.3 ) is vulnerable to a Stored Cross-site Scripting (XSS) issue. The root cause is the module's failure to sufficiently sanitize HTML code within the page name when it is rendered in the built-in tree browser . This allows an attacker, wh...

CVE-2026-81201: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

EUVD-2026-54300

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

PT-2026-67645

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers...

GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses

Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to neutralize security software as part of its defense evasion strategy. According to a new report published by the Threat Hunter Team from Symantec, the ransomware was first...

CVE-2026-8608

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capturepayment AJAX handler registered via wpajaxnoprivemcapturepayment trusting...

CVE-2026-8608

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capturepayment AJAX handler registered via wpajaxnoprivemcapturepayment trusting...

CVE-2026-8608: Insufficient Verification of Data Authenticity

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capturepayment AJAX handler registered via wpajaxnoprivemcapturepayment trusting...