Daily Writeups
@Daily_Writeups
3.56K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.56K subscribers
Daily Writeups
⤷ Title: Broadcast Hijack: Critical KiloView Flaw (CVSS 9.8) Grants Full Control
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 03 Feb 2026 02:05:23 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Takeover #Broadcast Security #CISA alert #CVE_2026_1453 #firmware update #IoT security #KiloView #Streaming Security #Video Encoder Security
Daily CyberSecurity
Broadcast Hijack: Critical KiloView Flaw (CVSS 9.8) Grants Full Control
Critical KiloView flaw CVE-2026-1453 (CVSS 9.8) allows unauthenticated admin takeover. Broadcast feeds at risk. Check affected E1/E2 versions immediately.
20 views
Daily Writeups
⤷ Title: Admins Only: Microsoft’s New Windows 11 Update Quietly Locks Down Storage Settings
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 03 Feb 2026 04:07:25 +0000
════════════════════════
⌗ Tags: #Windows #admin privileges #IT Management #KB5074105 #Storage Sense #Storage Settings #UAC prompt #Windows 11 #Windows 11 24H2 #Windows 11 25H2 #Windows security update
Daily CyberSecurity
Admins Only: Microsoft’s New Windows 11 Update Quietly Locks Down Storage Settings
Microsoft’s KB5074105 update adds a surprise security layer: only administrators can now access Storage settings. Standard users now face a mandatory UAC prompt.
14 views
Daily Writeups
⤷ Title: ATO Admin Account via Broken Password Reset Flow
════════════════════════
𐀪 Author: El Professor Qais
════════════════════════
ⴵ Time: Tue, 03 Mar 2026 13:47:09 GMT
════════════════════════
⌗ Tags: #account_takeover #vulnerability #ethical_hacking #admin_password_reset #bug_bounty
Medium
ATO Admin Account via Broken Password Reset Flow
Hi everyone! I’m Qais. Back again with the critical Bug Bounty story which I think everyone would like if they found out this simple Broken…
16 views
Daily Writeups
⤷ Title: ثغرة CVE-2026–20093 في Cisco IMC: تخطٍ كامل للمصادقة بصلاحيات Admin (CVSS 9.8)
════════════════════════
𐀪 Author: Rynbsd
════════════════════════
ⴵ Time: Sat, 04 Apr 2026 18:01:01 GMT
════════════════════════
⌗ Tags: #admin #cve #imc #hacking #cisco
Medium
ثغرة CVE-2026–20093 في Cisco IMC: تخطٍ كامل للمصادقة بصلاحيات Admin (CVSS 9.8)
ثغرة حرجة في Cisco IMC تتيح تجاوز المصادقة عن بُعد. تعرّف على الأجهزة المتأثرة والإجراءات العاجلة المطلوبة.
18 views
Daily Writeups
⤷ Title: Zero Authentication, Total Control: Critical CVSS 10 Flaw Uncovered in Dgraph Database
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sun, 05 Apr 2026 13:42:10 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ACID Transactions #Admin Mutation #Authorization Bypass #CVE_2026_33976 #CVSS 10.0 #database security #Dgraph #graphql #infosec #lfi #Patch Alert #ssrf
Daily CyberSecurity
Zero Authentication, Total Control: Critical CVSS 10 Flaw Uncovered in Dgraph Database
Dgraph patches a critical 10.0 CVSS flaw (CVE-2026-33976). Unauthenticated attackers can overwrite databases and read local files. Update to v25.3.1 now!
44 views
Daily Writeups
⤷ Title: Total CMS Takeover: Movable Type Patches Critical 9.8 CVSS Perl RCE
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 13 Apr 2026 02:12:06 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Panel Security #CMS Security #CVE_2026_25776 #CVE_2026_33088 #cybersecurity #infosec #Movable Type #Perl RCE #rce #Six Apart #sql injection
Daily CyberSecurity
Total CMS Takeover: Movable Type Patches Critical 9.8 CVSS Perl RCE
Movable Type patches a critical 9.8 CVSS RCE vulnerability in its Listing Framework. Secure your CMS against Perl code execution and SQLi—update today!
22 views
Daily Writeups
⤷ Title: Critical Command Injection Flaw Hits upKeeper Instant Privilege Access
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 17 Apr 2026 12:03:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Rights #Argument Injection #CVE_2026_2449 #CWE_88 #infosec #LocalSystem #Patch Alert #privilege escalation #upKeeper #Windows Security
Daily CyberSecurity
Critical Command Injection Flaw Hits upKeeper Instant Privilege Access
Critical 9.1 flaw in upKeeper Instant Privilege allows standard users to gain LocalSystem rights via command injection. Patch to v1.6.0.4576 immediately.
19 views
Daily Writeups
⤷ Title: Dgraph’s Debug Endpoint Hands Over Admin Tokens to Anyone
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sun, 19 Apr 2026 15:00:44 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Token #CVE_2026_40173 #cybersecurity #database security #Debug Endpoint #Dgraph #graphql #infosec #Patch Alert #Plain Text Credential #pprof
Daily CyberSecurity
Dgraph’s Debug Endpoint Hands Over Admin Tokens to Anyone
Dgraph (CVE-2026-40173) leaks admin tokens in plain text via unauthenticated debug endpoints. This critical 9.4 CVSS flaw allows full DB takeover. Patch now!
39 views
Daily Writeups
⤷ Title: Mailcow Critical Alert: Unauthenticated XSS Threatens Admin Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 23 Apr 2026 13:55:46 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Dashboard #Autodiscover #CVE_2026_40872 #docker #Email Security #infosec #mailcow #Patch Alert #Redis #Session Hijacking #Stored XSS #Web Security
Daily CyberSecurity
Mailcow Critical Alert: Unauthenticated XSS Threatens Admin Takeover
The popular open-source groupware suite mailcow: dockerized is facing a high-stakes security challenge. A critical Stored Cross-Site Scripting (XSS) vulnerability has been discovered in the platfo…
21 views
Daily Writeups
⤷ Title: Zero Delay, Total Loss: How a Compromised Key and a Disabled Timelock Cost Wasabi Protocol $5 Million
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 05 May 2026 07:24:09 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Admin Key Compromise #Blockaid #CertiK #Cryptocurrency Theft #Cyvers #DeFi Exploit #Ethereum #Governance Failure #Liquidity Provider #Smart Contract Security #Tornado Cash #Wasabi Protocol
Penetration Testing Tools
Zero Delay, Total Loss: How a Compromised Key and a Disabled Timelock Cost Wasabi Protocol $5 Million
The Wasabi Protocol was divested of millions of dollars within mere minutes, a catastrophe precipitated not by a
7 views
Daily Writeups
⤷ Title: Critical Strapi Flaws Enable Unauthenticated Admin Takeover and Server RCE
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 02:02:16 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Takeover #cms #CVE_2026_22599 #CVE_2026_27886 #Cyber Security #Headless CMS #infosec #Patch Alert #rce #sql injection #Strapi
Daily CyberSecurity
Critical Strapi Flaws Enable Unauthenticated Admin Takeover and Server RCE
Two critical flaws in Strapi CMS (CVE-2026-27886 & CVE-2026-22599) allow unauthenticated admin takeover and SQL injection. Update your nodes now!
21 views
Daily Writeups
⤷ Title: Under Siege: Critical Auth Bypass Flaw in Burst Statistics Plugin Puts 115,000+ WordPress Sites at Risk
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 06:44:34 +0000
════════════════════════
⌗ Tags: #Vulnerability #Admin Hijacking #authentication bypass #Burst Statistics #CVE_2026_8181 #Patch Update 2026 #Plugin Flaw #REST API Exploit #website security #Wordfence #WordPress Vulnerability
Penetration Testing Tools
Under Siege: Critical Auth Bypass Flaw in Burst Statistics Plugin Puts 115,000+ WordPress Sites at Risk
WordPress websites have once again fallen under siege due to a critical flaw in a popular extension. On
15 views
Daily Writeups
⤷ Title: The Ghost in the API: Attackers Hijack 700+ Ghost CMS Sites Using AI-Discovered SQL Flaw
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 26 May 2026 03:58:50 +0000
════════════════════════
⌗ Tags: #Vulnerability #Admin API key exfiltration #Anthropic Claude vulnerability discovery #ClickFix fake CAPTCHA attacks Ghost CMS #Ghost CMS CVE_2026_26980 exploitation #Ghost Content API blind SQLi #malicious JavaScript loader #QiAnXin XLab threat intelligence #web.telegram.ug C2 malware #website poisoning campaign #Windows Run dialog exploit
Information Security News
The Ghost in the API: Attackers Hijack 700+ Ghost CMS Sites Using AI-Discovered SQL Flaw - Information Security News
Hackers are actively exploiting a critical Ghost CMS SQL flaw (CVE-2026-26980) to hijack 700+ websites and serve fake Cloudflare ClickFix malware overlays.
15 views
Daily Writeups
⤷ Title: Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 22 Jun 2026 01:11:11 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #admin panel #Authorization Bypass #Avo #CVE_2026_55518 #Missing Authorization #privilege escalation #Rails Security #ruby on rails
Daily CyberSecurity
Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
CVE-2026-55518 is a critical Avo authorization bypass flaw enabling privilege escalation in Ruby on Rails admin panels. Update to Avo 3.32.1 now.
23 views
Daily Writeups
⤷ Title: Bypassing Authentication Gates: SQL Injection (Auth Bypass) on Login Portal
════════════════════════
𐀪 Author: M0stafaX404
════════════════════════
ⴵ Time: Fri, 17 Jul 2026 09:52:43 GMT
════════════════════════
⌗ Tags: #admin_takeover #web_security_academy #sql_injection #bug_bounty #cybersecurity
Medium
Bypassing Authentication Gates: SQL Injection (Auth Bypass) on Login Portal
Executive Summary
5 views
Daily Writeups
⤷ Title: How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
════════════════════════
𐀪 Author: Vishw Bhatt
════════════════════════
ⴵ Time: Fri, 24 Jul 2026 15:52:09 GMT
════════════════════════
⌗ Tags: #admin_panel #file_upload #bug_bounty
Medium
How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
A storage-exhaustion flaw. A stored XSS that waited for an admin. Both hiding in the same “boring” file upload form that hadn’t been…
19 views
Daily Writeups
⤷ Title: How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
════════════════════════
𐀪 Author: Vishw Bhatt
════════════════════════
ⴵ Time: Mon, 27 Jul 2026 09:37:44 GMT
════════════════════════
⌗ Tags: #admin_panel #file_upload #bug_bounty
Medium
How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
A storage-exhaustion flaw. A stored XSS that waited for an admin. Both hiding in the same “boring” file upload form that hadn’t been…
21 views
Daily Writeups
⤷ Title: CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8)
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Sat, 15 Aug 2026 04:03:55 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Takeover #Authentication Bypass #CVE_2026_15826 #User Profile Builder #WordPress Plugin Vulnerability #wordpress security
Daily CyberSecurity
CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8)
TL;DR: A critical User Profile Builder vulnerability, carrying a maximum CVSS score of 9.8 and tracked as CVE-2026-15826, now threatens more than 40,000 WordPress sites. It lets unauthenticated at…
14 views