Daily Writeups
@Daily_Writeups
3.57K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.57K subscribers
Daily Writeups
⤷ Title: Tap-and-Steal: Over 760 Android Apps Exploit NFC/HCE for Payment Card Theft in Global Financial Scam
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 03 Nov 2025 00:32:14 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Android NFC #Brazil #financial fraud #Host Card Emulation #Payment Card Theft #russia #Telegram C2
Daily CyberSecurity
Tap-and-Steal: Over 760 Android Apps Exploit NFC/HCE for Payment Card Theft in Global Financial Scam
Zimperium found 760+ Android apps exploiting NFC/HCE to steal payment data. The malware impersonates 20 banks across Russia, Poland, and Brazil, using Telegram for criminal coordination.
11 views
Daily Writeups
⤷ Title: NGate NFC Malware Steals Cash from ATMs by Relaying EMV Data and PINs from Victim’s Phone
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 05 Nov 2025 00:58:26 +0000
════════════════════════
⌗ Tags: #Malware #Android Malware #ATM Fraud #Banking Trojan #CERT Polska #EMV Theft #Host Card Emulation #NFC_relay #NGate
Daily CyberSecurity
NGate NFC Malware Steals Cash from ATMs by Relaying EMV Data and PINs from Victim's Phone
CERT Polska exposed NGate, an Android malware that tricks users into tapping their card against their phone to steal NFC EMV data and PINs. The data is then relayed to an ATM for cash withdrawal.
14 views
Daily Writeups
⤷ Title: Critical Triofox Zero-Day (CVE-2025-12480) Under Active Exploit: Host Header Bypass Allows Unauthenticated Admin Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 11 Nov 2025 02:01:48 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authentication Bypass #Gladinet #Host Header Spoofing #Mandiant #Triofox #UNC6485 #zero_day
Daily CyberSecurity
Critical Triofox Zero-Day (CVE-2025-12480) Under Active Exploit: Host Header Bypass Allows Unauthenticated Admin Takeover
Mandiant exposed UNC6485 exploiting a Triofox zero-day (CVE-2025-12480). The critical flaw allows unauthenticated admin takeover by spoofing the HTTP Host header to bypass authentication checks.
13 views
Daily Writeups
⤷ Title: Critical ZITADEL Flaws (CVE-2025-67494, CVSS 9.3) Risk SSRF Internal Breach and Account Hijack via XSS
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 10 Dec 2025 00:00:32 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authentication Bypass #CVE_2025_67494 #host header injection #Identity Management #ssrf #XSS #ZITADEL
Daily CyberSecurity
Critical ZITADEL Flaws (CVE-2025-67494, CVSS 9.3) Risk SSRF Internal Breach and Account Hijack via XSS
ZITADEL patched three high-severity flaws. Critical SSRF (9.3) allows internal breach via x-forward-host; XSS and Host Header Injection risk account hijack. Update to v4.7.1 immediately.
16 views
Daily Writeups
⤷ Title: The 9.6 Crack in Java’s Foundation: Critical Undertow Flaw CVE-2025-12543
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 09 Jan 2026 00:22:17 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Cache Poisoning #Critical Vulnerability #CVE_2025_12543 #host header injection #Java security #JBoss EAP #Undertow #WildFly
Daily CyberSecurity
The 9.6 Crack in Java’s Foundation: Critical Undertow Flaw CVE-2025-12543
A foundational crack has been discovered in the bedrock of the Java web ecosystem. Undertow, the high-performance web server that powers enterprise heavyweights like WildFly and JBoss EAP, has bee…
28 views
Daily Writeups
⤷ Title: Critical Appsmith Flaw CVE-2026-22794 Allows Account Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 14 Jan 2026 00:06:38 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Account Takeover #API security #Appsmith #CVE_2026_22794 #host header injection #Low Code Platform #Open Source Security #Password Reset Vulnerability
Daily CyberSecurity
Critical Appsmith Flaw CVE-2026-22794 Allows Account Takeover
Critical Appsmith flaw CVE-2026-22794 (CVSS 9.7) allows account takeover via Host Header Injection. Update to v1.93 immediately to secure your data.
21 views
Daily Writeups
⤷ Title: Code Red: 4 Critical SandboxJS Flaws (CVSS 10.0) Allow Host Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 09 Feb 2026 00:46:57 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary Code Execution #CVE_2026_25520 #CVE_2026_25586 #CVSS 10.0 #Host Prototype Pollution #JavaScript Security #Patch Alert #Sandbox Escape #SandboxJS #Web Security
Daily CyberSecurity
Code Red: 4 Critical SandboxJS Flaws (CVSS 10.0) Allow Host Takeover
Critical SandboxJS flaws (CVSS 10.0) allow sandbox escape & host takeover via prototype pollution. Update to v0.8.29 immediately to stop code execution.
18 views
Daily Writeups
⤷ Title: CVE-2025-62878: Critical 10.0 Vulnerability Found in Kubernetes Local Path Provisioner
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 09 Feb 2026 00:11:07 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #container security #CVE_2025_62878 #CVSS 10.0 #Host Escape #K8s #Kubernetes #Local Path Provisioner #Patch Alert #Path Traversal #Rancher
Daily CyberSecurity
CVE-2025-62878: Critical 10.0 Vulnerability Found in Kubernetes Local Path Provisioner
CVSS 10.0 Alert: Kubernetes Local Path Provisioner flaw (CVE-2025-62878) allows host file overwrites. Upgrade to v0.0.34 immediately.
17 views
Daily Writeups
⤷ Title: Critical Undertow Flaw (CVSS 9.6) Strikes HPE Telco Service Activator
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 04:20:19 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2025_12543 #Cyber Security #Host Header Validation #HPE Service Activator #Patch Alert #Session Hijacking #Telecommunications Security #Undertow HTTP Server #Web Cache Poisoning
Daily CyberSecurity
Critical Undertow Flaw (CVSS 9.6) Strikes HPE Telco Service Activator
Critical Undertow HTTP server flaw CVE-2025-12543 (CVSS 9.6) impacts HPE Telco Service Activator, allowing cache poisoning and session hijacking. Patch now.
16 views
Daily Writeups
⤷ Title: What is HTTP Host Header Attacks
════════════════════════
𐀪 Author: BinaryShield
════════════════════════
ⴵ Time: Tue, 24 Feb 2026 14:30:36 GMT
════════════════════════
⌗ Tags: #vulnerability #host_header_injection #cybersecurity #ethical_hacking #penetration_testing
Medium
What is HTTP Host Header Attacks
🧠 1) What it is
40 views
Daily Writeups
⤷ Title: CVE-2026-34208 (CVSS 10): Critical Sandbox Escape Uncovered in SandboxJS
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 08 Apr 2026 13:07:55 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_34208 #cybersecurity #Host Poisoning #infosec #JavaScript Security #Node.js #rce #Sandbox Breach #Sandbox Escape #SandboxJS #supply chain attack
Daily CyberSecurity
CVE-2026-34208 (CVSS 10): Critical Sandbox Escape Uncovered in SandboxJS
CVE-2026-34208: A critical 10.0 flaw in SandboxJS allows code to escape and poison host objects like Math.random. Secure your environment—update immediately!
19 views
Daily Writeups
⤷ Title: From Misconfigured Virtual Host Routing to Internal Source Code Disclosure
════════════════════════
𐀪 Author: abdulrahman
════════════════════════
ⴵ Time: Tue, 26 May 2026 11:23:51 GMT
════════════════════════
⌗ Tags: #vulnerability #bug_bounty_writeup #host_header #original_ips #backend
40 views
Daily Writeups
⤷ Title: Host Header Injection
════════════════════════
𐀪 Author: Unknown KP
════════════════════════
ⴵ Time: Tue, 16 Jun 2026 15:55:16 GMT
════════════════════════
⌗ Tags: #hacking #cybersecurity #host_header_injection
Medium
Host Header Injection
A practical guide covering the vulnerability, real-world impact, bypass techniques, and a step-by-step lab walkthrough.
12 views
Daily Writeups
⤷ Title: LiteLLM Authentication Bypass via Host Header Injection (CVE-2026-49468)
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 19 Jun 2026 01:35:50 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI Gateway #API security #Authentication Bypass #CVE_2026_49468 #CWE_290 #FastAPI #host header injection #LiteLLM #LLM Proxy #Starlette
Daily CyberSecurity
LiteLLM Authentication Bypass via Host Header Injection (CVE-2026-49468)
A critical LiteLLM authentication bypass (CVE-2026-49468) lets crafted Host Header Injection reach protected AI Gateway routes. Patch in 1.84.0.
21 views
Daily Writeups
⤷ Title: Reasearch on Host Header Injection
════════════════════════
𐀪 Author: Tanisha Bangera
════════════════════════
ⴵ Time: Sat, 27 Jun 2026 13:04:29 GMT
════════════════════════
⌗ Tags: #cybersecurity #penetration_testing #host_header_injection
Medium
Reasearch on Host Header Injection
Why trusting the Host header can quietly break your website’s security
17 views
Daily Writeups
⤷ Title: Understanding Host Header Injection
════════════════════════
𐀪 Author: Chandan
════════════════════════
ⴵ Time: Sun, 12 Jul 2026 16:33:11 GMT
════════════════════════
⌗ Tags: #vulnversity #owasp_top_10 #xss_vulnerability #ethical_hacking #host_header_injection
Medium
Understanding Host Header Injection
A Complete Guide for Security Researchers
31 views