Daily Writeups
@Daily_Writeups
3.55K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.55K subscribers
Daily Writeups
⤷ Title: Dgraph’s Debug Endpoint Hands Over Admin Tokens to Anyone
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sun, 19 Apr 2026 15:00:44 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Token #CVE_2026_40173 #cybersecurity #database security #Debug Endpoint #Dgraph #graphql #infosec #Patch Alert #Plain Text Credential #pprof
Daily CyberSecurity
Dgraph’s Debug Endpoint Hands Over Admin Tokens to Anyone
Dgraph (CVE-2026-40173) leaks admin tokens in plain text via unauthenticated debug endpoints. This critical 9.4 CVSS flaw allows full DB takeover. Patch now!
39 views
Daily Writeups
⤷ Title: Mailcow Critical Alert: Unauthenticated XSS Threatens Admin Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 23 Apr 2026 13:55:46 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Dashboard #Autodiscover #CVE_2026_40872 #docker #Email Security #infosec #mailcow #Patch Alert #Redis #Session Hijacking #Stored XSS #Web Security
Daily CyberSecurity
Mailcow Critical Alert: Unauthenticated XSS Threatens Admin Takeover
The popular open-source groupware suite mailcow: dockerized is facing a high-stakes security challenge. A critical Stored Cross-Site Scripting (XSS) vulnerability has been discovered in the platfo…
21 views
Daily Writeups
⤷ Title: Zero Delay, Total Loss: How a Compromised Key and a Disabled Timelock Cost Wasabi Protocol $5 Million
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 05 May 2026 07:24:09 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Admin Key Compromise #Blockaid #CertiK #Cryptocurrency Theft #Cyvers #DeFi Exploit #Ethereum #Governance Failure #Liquidity Provider #Smart Contract Security #Tornado Cash #Wasabi Protocol
Penetration Testing Tools
Zero Delay, Total Loss: How a Compromised Key and a Disabled Timelock Cost Wasabi Protocol $5 Million
The Wasabi Protocol was divested of millions of dollars within mere minutes, a catastrophe precipitated not by a
7 views
Daily Writeups
⤷ Title: Critical Strapi Flaws Enable Unauthenticated Admin Takeover and Server RCE
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 02:02:16 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Admin Takeover #cms #CVE_2026_22599 #CVE_2026_27886 #Cyber Security #Headless CMS #infosec #Patch Alert #rce #sql injection #Strapi
Daily CyberSecurity
Critical Strapi Flaws Enable Unauthenticated Admin Takeover and Server RCE
Two critical flaws in Strapi CMS (CVE-2026-27886 & CVE-2026-22599) allow unauthenticated admin takeover and SQL injection. Update your nodes now!
21 views
Daily Writeups
⤷ Title: Under Siege: Critical Auth Bypass Flaw in Burst Statistics Plugin Puts 115,000+ WordPress Sites at Risk
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 06:44:34 +0000
════════════════════════
⌗ Tags: #Vulnerability #Admin Hijacking #authentication bypass #Burst Statistics #CVE_2026_8181 #Patch Update 2026 #Plugin Flaw #REST API Exploit #website security #Wordfence #WordPress Vulnerability
Penetration Testing Tools
Under Siege: Critical Auth Bypass Flaw in Burst Statistics Plugin Puts 115,000+ WordPress Sites at Risk
WordPress websites have once again fallen under siege due to a critical flaw in a popular extension. On
14 views
Daily Writeups
⤷ Title: The Ghost in the API: Attackers Hijack 700+ Ghost CMS Sites Using AI-Discovered SQL Flaw
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 26 May 2026 03:58:50 +0000
════════════════════════
⌗ Tags: #Vulnerability #Admin API key exfiltration #Anthropic Claude vulnerability discovery #ClickFix fake CAPTCHA attacks Ghost CMS #Ghost CMS CVE_2026_26980 exploitation #Ghost Content API blind SQLi #malicious JavaScript loader #QiAnXin XLab threat intelligence #web.telegram.ug C2 malware #website poisoning campaign #Windows Run dialog exploit
Information Security News
The Ghost in the API: Attackers Hijack 700+ Ghost CMS Sites Using AI-Discovered SQL Flaw - Information Security News
Hackers are actively exploiting a critical Ghost CMS SQL flaw (CVE-2026-26980) to hijack 700+ websites and serve fake Cloudflare ClickFix malware overlays.
14 views
Daily Writeups
⤷ Title: Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 22 Jun 2026 01:11:11 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #admin panel #Authorization Bypass #Avo #CVE_2026_55518 #Missing Authorization #privilege escalation #Rails Security #ruby on rails
Daily CyberSecurity
Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
CVE-2026-55518 is a critical Avo authorization bypass flaw enabling privilege escalation in Ruby on Rails admin panels. Update to Avo 3.32.1 now.
22 views
Daily Writeups
⤷ Title: Bypassing Authentication Gates: SQL Injection (Auth Bypass) on Login Portal
════════════════════════
𐀪 Author: M0stafaX404
════════════════════════
ⴵ Time: Fri, 17 Jul 2026 09:52:43 GMT
════════════════════════
⌗ Tags: #admin_takeover #web_security_academy #sql_injection #bug_bounty #cybersecurity
Medium
Bypassing Authentication Gates: SQL Injection (Auth Bypass) on Login Portal
Executive Summary
5 views
Daily Writeups
⤷ Title: How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
════════════════════════
𐀪 Author: Vishw Bhatt
════════════════════════
ⴵ Time: Fri, 24 Jul 2026 15:52:09 GMT
════════════════════════
⌗ Tags: #admin_panel #file_upload #bug_bounty
Medium
How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
A storage-exhaustion flaw. A stored XSS that waited for an admin. Both hiding in the same “boring” file upload form that hadn’t been…
18 views
Daily Writeups
⤷ Title: How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
════════════════════════
𐀪 Author: Vishw Bhatt
════════════════════════
ⴵ Time: Mon, 27 Jul 2026 09:37:44 GMT
════════════════════════
⌗ Tags: #admin_panel #file_upload #bug_bounty
Medium
How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.
A storage-exhaustion flaw. A stored XSS that waited for an admin. Both hiding in the same “boring” file upload form that hadn’t been…
20 views