正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

🚨CVE-2025-26529: Moodle XSS to RCE Exploit Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.

Dark Web Informer

221,798 subscribers

22,954 次观看 • 7 个月前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

0 条评论

暂无评论

原始帖子的评论将显示在这里

相关视频

🚨PoC for CVE-2024-46538 PfSense Stored XSS lead to RCE

🚨PoC for CVE-2024-46538 PfSense Stored XSS lead to RCE

Dark Web Informer

64,458 次观看 • 1 年前

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]

Ron Masas

76,747 次观看 • 2 年前

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss

Today Cyber News

34,216 次观看 • 2 年前

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

Gospel

12,881 次观看 • 9 个月前

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇

🚨 wp2shell : pre-auth RCE in WordPress core, reproduced end-to-end. Nested /batch/v1 "double confusion" · (CVE-2026-63030) → WP_Query SQLi · (CVE-2026-60137) → anonymous shell on a stock install. A couple of prompts later: · Opus 4.8 orchestrating, Sonnet agents executing. Exploit dev has gotten scary easy. Patched in 6.9.5 / 7.0.2 - update now. 👇

Aseem Shrey

33,300 次观看 • 21 天前

PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400). If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password. We reverse engineered Apple’s unusual macOS 26.6.1 patch to understand the root cause and exploitation path. Please upgrade your macOS boxes to 26.6.1. Full technical writeup drops tomorrow.

PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400). If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password. We reverse engineered Apple’s unusual macOS 26.6.1 patch to understand the root cause and exploitation path. Please upgrade your macOS boxes to 26.6.1. Full technical writeup drops tomorrow.

Calif

330,739 次观看 • 1 天前

In Uttar Pradesh, during a Shivratri procession in Maurawan, district Unnao, an incident reportedly occurred at the Eidgah where an Hanuman climbed onto the religious structure, allegedly causing disrespect to the site. The police administration was reportedly unable to prevent the incident. #IslamophobiaInIndia

In Uttar Pradesh, during a Shivratri procession in Maurawan, district Unnao, an incident reportedly occurred at the Eidgah where an Hanuman climbed onto the religious structure, allegedly causing disrespect to the site. The police administration was reportedly unable to prevent the incident. #IslamophobiaInIndia

Team Rising Falcon

26,299 次观看 • 5 个月前

Everyone deserves to live without threats to their safety. I’m asking Prime Minister Carney to list the Lawrence Bishnoi gang as a terrorist group in Canada, which will give police additional tools they need to stop and prevent the extortion of Canadians.

Everyone deserves to live without threats to their safety. I’m asking Prime Minister Carney to list the Lawrence Bishnoi gang as a terrorist group in Canada, which will give police additional tools they need to stop and prevent the extortion of Canadians.

David Eby

54,293 次观看 • 1 年前

Better late than never! Samsung now supports NFC Access Cards in Samsung Wallet. So, your office and apartment NFC access cards can now be stored and used on your Galaxy phone. You can also use the card information stored on your phone as a base for other supported Samsung phones to copy and scan. Unlike payment cards, there’s no authentication required before using the card. Hence, it’s both a convenience and a security risk. To access this feature under Digital Key, you will need to be running One UI 7 at least and updated to Samsung Wallet version 6.0.85 #Samsung #SamsungWallet #NFCCard

Better late than never! Samsung now supports NFC Access Cards in Samsung Wallet. So, your office and apartment NFC access cards can now be stored and used on your Galaxy phone. You can also use the card information stored on your phone as a base for other supported Samsung phones to copy and scan. Unlike payment cards, there’s no authentication required before using the card. Hence, it’s both a convenience and a security risk. To access this feature under Digital Key, you will need to be running One UI 7 at least and updated to Samsung Wallet version 6.0.85 #Samsung #SamsungWallet #NFCCard

SoyaCincau

14,344 次观看 • 1 年前

🚨#BREAKING: The Biden administration has offered more than half a million Venezuelan migrants in the U.S. the ability to live and work in the country legally

🚨#BREAKING: The Biden administration has offered more than half a million Venezuelan migrants in the U.S. the ability to live and work in the country legally

R A W S A L E R T S

757,684 次观看 • 2 年前

.Congresswoman Jasmine Crockett: "I think that I would trust [Congress] more than I would trust the DOJ deciding that they're going to interview [Maxwell] and then potentially sanitizing the information that we get, or potentially engaging in some type of threats, or potentially offering a pardon if certain things were said or not said... I don't know what may happen to that witness if the administration gets to her first."

.Congresswoman Jasmine Crockett: "I think that I would trust [Congress] more than I would trust the DOJ deciding that they're going to interview [Maxwell] and then potentially sanitizing the information that we get, or potentially engaging in some type of threats, or potentially offering a pardon if certain things were said or not said... I don't know what may happen to that witness if the administration gets to her first."

Brian Tyler Cohen

42,140 次观看 • 1 年前

Hey Palworld, our private server was infiltrated by individuals claiming to be 'Nintendo Hackers,' resulting in the rapid destruction of our entire base. They gained access without invitation, exploiting the server name displayed on my stream to obtain our IP. Is there a way to add streamer mode like in other games to conceal sensitive information such as server name and passwords with asterisks to prevent unauthorized access in the future?

Hey Palworld, our private server was infiltrated by individuals claiming to be 'Nintendo Hackers,' resulting in the rapid destruction of our entire base. They gained access without invitation, exploiting the server name displayed on my stream to obtain our IP. Is there a way to add streamer mode like in other games to conceal sensitive information such as server name and passwords with asterisks to prevent unauthorized access in the future?

Baker

12,805 次观看 • 2 年前

🚨 BREAKING🚨: RM Rep. Jamie Raskin shares an email, obtained by American Oversight, from a Project 2025 leader promising access to jobs in a future Trump Administration in exchange for “real commitment” and “valuable contributions” to the extremist MAGA manifesto.

🚨 BREAKING🚨: RM Rep. Jamie Raskin shares an email, obtained by American Oversight, from a Project 2025 leader promising access to jobs in a future Trump Administration in exchange for “real commitment” and “valuable contributions” to the extremist MAGA manifesto.

Oversight Dems

468,770 次观看 • 1 年前

🚨 UPDATE: A major chemical tank is at risk of catastrophic failure in Orange County CA, prompting urgent evacuations across the area. Officials are scrambling to prevent a potential disaster. This is serious. Praying for the safety of everyone in the affected zone.

🚨 UPDATE: A major chemical tank is at risk of catastrophic failure in Orange County CA, prompting urgent evacuations across the area. Officials are scrambling to prevent a potential disaster. This is serious. Praying for the safety of everyone in the affected zone.

Gunther Eagleman™

101,570 次观看 • 2 个月前

🚨 Multiple users are reporting that Kash Patel’s apparel site is serving a ClickFix-style malware lure. The page appears to mimic a Cloudflare verification check and instructs visitors to run platform-specific commands to “verify” access. Instead, those commands can execute malicious code. On macOS, the observed chain reportedly pulls down an infostealer designed to target Keychain data, browser-stored credentials, session tokens, and cryptocurrency wallet information.

🚨 Multiple users are reporting that Kash Patel’s apparel site is serving a ClickFix-style malware lure. The page appears to mimic a Cloudflare verification check and instructs visitors to run platform-specific commands to “verify” access. Instead, those commands can execute malicious code. On macOS, the observed chain reportedly pulls down an infostealer designed to target Keychain data, browser-stored credentials, session tokens, and cryptocurrency wallet information.

Dark Web Informer

38,839 次观看 • 2 个月前

The Biden Administration allowed a suspected Hamas TERRORIST, who was allegedly involved in massacring 69 innocents on October 7, to live in America. The Biden Administration’s visa vetting was reckless, negligent and put American lives at risk. Tricia McLaughlin

The Biden Administration allowed a suspected Hamas TERRORIST, who was allegedly involved in massacring 69 innocents on October 7, to live in America. The Biden Administration’s visa vetting was reckless, negligent and put American lives at risk. Tricia McLaughlin

Homeland Security

212,439 次观看 • 9 个月前

🚨 #Breaking: At least one woman was shot at Great Lakes Crossing in Auburn Hills on Saturday and was taken to a local hospital. The suspect is in custody. Police say there is no danger to the public, and additional information is expected to be released as it becomes available.

🚨 #Breaking: At least one woman was shot at Great Lakes Crossing in Auburn Hills on Saturday and was taken to a local hospital. The suspect is in custody. Police say there is no danger to the public, and additional information is expected to be released as it becomes available.

Metro Detroit News

99,050 次观看 • 28 天前