CVE-2026-52777 YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6...

EUVD-2026-71808

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6...

CVE-2026-52777 YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6...

EUVD-2026-71807

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

CVE-2026-52775 YesWiki Authenticated SQL Injection in ReactionManager

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

CVE-2026-52775

YesWiki (PHP wiki system) prior to version 4.6.6 is vulnerable to an authenticated SQL injection in ReactionManager::deleteUserReaction(). The {idreaction} and {id} URL path parameters are concatenated directly into a SQL LIKE clause without escaping, while a sibling code path correctly applies $...

CVE-2026-52775 YesWiki Authenticated SQL Injection in ReactionManager

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

CVE-2026-52774

YesWiki (a PHP wiki system) is vulnerable to reflected XSS (CWE-79) in its Bazar widget handler prior to version 4.6.6. The id GET parameter is reflected into the data-formid and data-iframeUrl HTML attributes using only strip_tags(), which does not escape double quotes. An unauthenticated attack...

CVE-2026-52774 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

EUVD-2026-71806

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

CVE-2026-52774 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

sigma-rules

Sigma ルール Joe Security がサンドボックスでの脅威ハンティング用に作成したコミュニティ Sigma ルールで、GPL ライセンスの下で提供されています。サンドボックス向け Sigma ルールの詳細については、こちらのブログ記事をご覧ください。...

chall.stypr.com

chall.stypr.com chall.stypr.com에 플레이해 주셔서 감사합니다. 제가 처음으로 워게임을 설정하고 호스팅한 지 9년이 되었습니다. 많은 CTF에서 이미 유사한 문제를 재사용하거나 만들었기 때문에, 챌린지 인프라를 호스팅하는 데 사용된 모든 챌린지와 구성의 소스 코드를 공유하기로 결정했습니다. 인프라 web/: https://chall.stypr.com/의 소스 코드 challenges/: https://.eagle-jump.org/의 구성 및 소스 코드 데이터베이스 점수판 백업 총 사용자 수: 3021|...

Silhouette

Silhouette Gabriel Landau 및 Mark Mager 제작, Elastic Security 소속. Shmoocon 2023에서 발표된 Hide Your Valuables — Mitigating Physical Credential Dumping Attacks에서. 슬라이드는 여기. LSA 비밀정보를 물리 메모리에서 보호하기 Silhouette은 LSASS에서 자격 증명을 덤프하기 위해 물리 메모리를 사용하는 것을 완화하는 POC입니다. 다음 세 가지 방식으로 이를 수행합니다: 1. LSASS의 페이지를 RAM에서...

amd-ryzen-master-driver-v17-exploit

AMDのRyzen Master Driver（バージョン17）を使用したカーネルエクスプロイト用のCobalt Strikeビーコンオブジェクトファイル。 Tijme制作。教えてくれたAlexに感謝！ Northwave Securityの支援により実現 説明 これは、AMDのRyzen Master Driver（バージョン17）を悪用するCobalt...

EUVD-2026-71805

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773

YesWiki (PHP wiki system), versions 4.1.0 through 4.6.5 , is vulnerable to a reflected XSS (CWE-79) in the archived-revision view. The time GET parameter is reflected unescaped into a hidden HTML input in handlers/page/show.php. Because MySQL coerces malformed DATETIME strings, an attacker append...

AppSecEzine

AppSec Ezine 보안 위험 예방에 대한 인식을 높이는 것은 어려운 일입니다. 대부분의 사람들은 올바른 정보를 인지하지 못하거나 접근할 수 없습니다. 기술 세계에서 속도를 유지하는 것은 황금률입니다. 보안 문제에 대처할 준비가 되어 있지 않다면, 당신은 잘못된 방향으로 가고 있는 것입니다. AppSec Ezine은 정보 보안에 관한 콘텐츠를 큐레이션해야 할 필요성에서 탄생했습니다. 그렇지 않으면 웹 곳곳에 흩어져 있을 수 있는 콘텐츠를 말이죠. 각 호는 광범위한 주제를 다룹니다. AppSec Ezine은 당신이 알아야 할...