wix-kickstartx-challenge-writeup

Wix KickstartX Challenge 2026 — Full Writeup Result: 200/200 100% — Token: WKX-9245FA70-200 Date: March 24, 2026 1. Discovery & Reconnaissance The Challenge Announcement A LinkedIn post announced a special challenge for Wix KickstartX — a junior developer program. The rules: 30 minutes, one...

CVE-2023-43149

CVE-2023-43149 Author : Aitor Herrero Fuentes Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/admin Version: 1.9.0.3 Tested on: Windows 10 Pro CSRF ADD ROOT ACCOUNT Cross Site Request Forgery vulnerability in application demo.spa-cart.com allows a...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

CVE-2023-43148

CVE-2023-43148 Author : Aitor Herrero Fuentes Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/admin Version: 1.9.0.3 Tested on: Windows 10 Pro CSRF DELETE ALL ACCOUNT Cross Site Request Forgery vulnerability in application demo.spa-cart.com allows ...

DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-

Welcome to React Router! A modern, production-ready template for building full-stack React applications using React Router. Features 🚀 Server-side rendering ⚡️ Hot Module Replacement HMR 📦 Asset bundling and optimization 🔄 Data loading and mutations 🔒 TypeScript by default 🎉 TailwindCSS for stylin...

domdig

DOMDig DOMDig es un escáner de DOM XSS que se ejecuta dentro del navegador web Chromium y puede escanear aplicaciones de página única SPA de forma recursiva. A diferencia de otros escáneres, DOMDig puede rastrear cualquier aplicación web incluyendo gmail manteniendo un registro de las...

htcap

HTCAP htcap es un escáner de aplicaciones web capaz de rastrear aplicaciones de una sola página SPA de forma recursiva interceptando llamadas ajax y cambios en el DOM. CARACTERÍSTICAS PRINCIPALES Motor de rastreo DOM recursivo Descubre solicitudes ajax/fetch/jsonp/websocket Soporta cookies, proxy...

Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

MAL-2026-17690 Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

PYSEC-2026-4041 djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

PT-2026-105798

Impact djust's per-object authorization get object + has object permission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA url change navigation, and c % live render % embedded child views. An...

AlmaLinux 9.2 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778297730)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778297730 advisory. - In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malforme...

CentOS Linux 6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (CENTOS6:CLSA-2026:1778024392)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778024392 advisory. - In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that...

PT-2026-94122

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description An issue exists in the per-object authorization mechanism involving the get object and has object permission functions. While authorization was enforced on WebSocket mount and event paths, it was missi...

Astra Linux – Vulnerability in exim4

In Exim versions before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be a vulnerability where an out-of-bounds write could cause the connection instance to crash, or erroneous data processing could lead to data being leaked from uninitialized heap...

wagtail-embedvideos (5.1.0), wagtail-reoako (2.1.1) +2 more potentially affected by CVE-2026-55468 via wagtail (5.1.3)

wagtail PYPI version 5.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-embedvideos 5.1.0 - wagtail-reoako 2.1.1 - wagtail-spa-integration =2.1.0, =2.1.3 - wagtail-treemodeladmin 1.8.0 Source cves: CVE-2026-554...

SPA: Securing Persistent LLM Agents across Queries with Plan-First Information-Flow Control

Large language model LLM agents increasingly operate over untrusted webpages, documents, tools, and persistent states while exercising authority over security-sensitive resources. Existing defenses typically protect either planning or individual tool interactions, but persistent agents face a...

Malicious Package

Overview devplatform-spa-tokens is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...