Daily Writeups
@Daily_Writeups
3.58K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.58K subscribers
Daily Writeups
⤷ Title: decompress npm Vulnerability CVE-2026-53486 (CVSS 9.1) Threatens 2.8 Million Weekly Downloads
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Sun, 12 Jul 2026 13:00:11 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary File Write #CVE_2026_53486 #decompress #Node.js Security #npm Security #Path Traversal #Supply Chain Security
Daily CyberSecurity
decompress npm Vulnerability CVE-2026-53486 (CVSS 9.1) Threatens 2.8 Million Weekly Downloads
TL;DR A high-severity decompress npm vulnerability lets crafted archives write files outside the extraction folder. Tracked as CVE-2026-53486, the flaw carries a CVSS score of 9.1. It sits in a li…
40 views
Daily Writeups
⤷ Title: CVE-2026-59948: PHP Composer Flaw Lets Packages Execute Code Outside the Project Context
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 14 Jul 2026 13:30:50 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary File Write #CVE_2026_59946 #CVE_2026_59947 #CVE_2026_59948 #Path Traversal #PHP Composer #Supply Chain
Daily CyberSecurity
CVE-2026-59948: PHP Composer Flaw Lets Packages Execute Code Outside the Project Context
TL;DR PHP Composer, the main dependency manager for the language, patched three security flaws. The most serious, CVE-2026-59948, is an arbitrary file write rated CVSS 7.0. A malicious package can…
8 views
Daily Writeups
⤷ Title: Notepad++ v8.9.7 Fixes 5 Vulnerabilities, All With Public Details and PoC Exploit Code
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 15 Jul 2026 02:28:16 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #buffer overflow #notepad++ #Path Traversal #Zip Slip
Daily CyberSecurity
Notepad++ v8.9.7 Fixes 5 Vulnerabilities, All With Public Details and PoC Exploit Code
TL;DR Notepad++ v8.9.7 fixes five security flaws in the popular Windows editor. Technical details and proof-of-concept exploit code for all five Notepad++ vulnerabilities are public in the project…
9 views
Daily Writeups
⤷ Title: CVE-2026-49488: Arbitrary File Read Flaw in Apache OpenMeetings Exposes Server Credentials
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 21 Jul 2026 12:25:58 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #apache #Apache OpenMeetings #Arbitrary File Read #Path Traversal
Daily CyberSecurity
CVE-2026-49488: Arbitrary File Read Flaw in Apache OpenMeetings Exposes Server Credentials
TL;DR Apache has patched a critical OpenMeetings vulnerability tracked as CVE-2026-49488. The path traversal flaw grants arbitrary file read to any user with moderator rights in a room. Version 9.…
17 views
Daily Writeups
⤷ Title: Vitest Flaw Rated CVSS 9.4 Hits an npm Package With 65 Million Weekly Downloads
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 22 Jul 2026 02:12:08 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary File Read #GHSA_p63j_vcc4_9vmv #javascript #npm #Path Traversal #Supply Chain Security #Vite #Vitest #Vitest Browser Mode
Daily CyberSecurity
Vitest Flaw Rated CVSS 9.4 Hits an npm Package With 65 Million Weekly Downloads
TL;DR Vitest patched a critical vulnerability rated CVSS 9.4. Browser Mode commands could read, write, or delete files outside the project folder. They did so even when the allowWrite gate was set…
10 views
Daily Writeups
⤷ Title: ADAudit Plus Flaw CVE-2026-6516 Allows Unauthenticated Remote Code Execution at CVSS 10
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 24 Jul 2026 02:50:50 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #active directory #ADAudit Plus #Authentication Bypass #CVE_2026_6516 #ManageEngine #patch management #Path Traversal #unauthenticated RCE #Zoho
Daily CyberSecurity
ADAudit Plus Flaw CVE-2026-6516 Allows Unauthenticated Remote Code Execution at CVSS 10
TL;DR ManageEngine patched a critical ADAudit Plus vulnerability tracked as CVE-2026-6516. Two weaknesses in the product’s Agent APIs, an authentication bypass and a path traversal, chain in…
16 views
Daily Writeups
⤷ Title: How a Simple language Parameter Exposed an Internal Drupal CMS
════════════════════════
𐀪 Author: Thomas Youssef
════════════════════════
ⴵ Time: Tue, 28 Jul 2026 13:19:31 GMT
════════════════════════
⌗ Tags: #cybersecurity #bug_bounty #path_traversal #bug_bounty_tips #bug_bounty_writeup
Medium
How a Simple language Parameter Exposed an Internal Drupal CMS
Hello friend, I’m Thomas Youssef
16 views
Daily Writeups
⤷ Title: Lab Solved: File Path Traversal — Absolute Path Bypass
════════════════════════
𐀪 Author: Ethical Hacker
════════════════════════
ⴵ Time: Tue, 28 Jul 2026 14:51:38 GMT
════════════════════════
⌗ Tags: #bug_bounty #ethical_hacking #information_disclosure #cybersecurity #path_traversal
Medium
🚀 Lab Solved: File Path Traversal — Absolute Path Bypass
Successfully completed the “File path traversal, traversal sequences blocked with absolute path bypass” lab from PortSwigger Web Security…
5 views
Daily Writeups
⤷ Title: IBM Aspera Vulnerabilities Patched in Faspex 5 and Desktop App
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 29 Jul 2026 02:03:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Aspera Faspex #CVE_2026_14958 #CVE_2026_14959 #CVE_2026_14973 #IBM Aspera #IBM Aspera Desktop #Path Traversal #Remote Code Execution
Daily CyberSecurity
IBM Aspera Vulnerabilities Patched in Faspex 5 and Desktop App
TL;DR IBM patched five IBM Aspera vulnerabilities across two products on July 20, 2026. They affect Aspera Faspex 5 and the Aspera Desktop App. The worst flaws reach a CVSS score of 9.3 and allow …
9 views
Daily Writeups
⤷ Title: CVE-2026-63223: CodeIgniter4 RCE Vulnerability Rated CVSS 9.8
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 31 Jul 2026 09:19:03 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CodeIgniter4 #CVE_2026_63223 #File Upload Vulnerability #Path Traversal #PHP Framework #Remote Code Execution #sql injection #Web Security
Daily CyberSecurity
CVE-2026-63223: CodeIgniter4 RCE Vulnerability Rated CVSS 9.8
TL;DR: The CodeIgniter4 team patched four security flaws in release v4.7.4. The most severe, a CodeIgniter4 RCE vulnerability tracked as CVE-2026-63223, scores CVSS 9.8. It can lead to remote code…
25 views
Daily Writeups
⤷ Title: Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code Execution
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 04 Aug 2026 07:53:22 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary File Read #CVE_2026_59774 #Gitea #Path Traversal #rce #Remote Code Execution #Vulnerability
Daily CyberSecurity
Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code Execution
TL;DR Gitea 1.27.1 patches a critical Gitea vulnerability, CVE-2026-59774, rated CVSS 9.8. An unauthenticated attacker can read arbitrary server files through a public repository, then escalate to…
10 views
Daily Writeups
⤷ Title: Linux Privilege Escalation: Capabilities & PATH Hijacking | TryHackMe
════════════════════════
𐀪 Author: Dharavathnagaraju
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 16:28:00 GMT
════════════════════════
⌗ Tags: #ethical_hacking #tryhackme #privilege_escalation #capabilities #path_hijacking
Medium
Linux Privilege Escalation: Capabilities & PATH Hijacking | TryHackMe
In this TryHackMe lab, I explored two important Linux privilege-escalation techniques: Linux Capabilities and PATH Hijacking. I learned how…
17 views
Daily Writeups
⤷ Title: BigBlueButton Fixes Maximum Severity Arbitrary File Read Flaw
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 18 Aug 2026 00:09:09 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #BigBlueButton #CVE_2026_XXXX #Path Traversal
Daily CyberSecurity
BigBlueButton Fixes Maximum Severity Arbitrary File Read Flaw
TL;DR BigBlueButton contains a critical path traversal vulnerability within the Etherpad integration. Attackers can perform an unauthenticated arbitrary file read to extract sensitive system files…
10 views
Daily Writeups
⤷ Title: CVE-2026-18051 (CVSS 10): Unauthenticated Arbitrary File Write Hits 900k W3 Total Cache Sites
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 19 Aug 2026 08:53:14 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary File Write #CVE_2026_18051 #Path Traversal #W3 Total Cache #wordpress #WordPress Plugin #wpscan
Daily CyberSecurity
CVE-2026-18051 (CVSS 10): Unauthenticated Arbitrary File Write Hits 900k W3 Total Cache Sites
TL;DR A critical W3 Total Cache vulnerability lets unauthenticated attackers write files anywhere on the server. Tracked as CVE-2026-18051, it earns the top CVSS score of 10. The plugin runs on mo…
9 views
Daily Writeups
⤷ Title: IBM Db2 Mirror for i Hit by CVE-2026-17186 RCE Flaw (CVSS 9.9)
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 19 Aug 2026 13:15:45 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authentication Bypass #Command Injection #CVE_2026_17182 #CVE_2026_17184 #CVE_2026_17186 #Db2 Mirror for i #IBM #IBM i #Path Traversal #Remote Code Execution
Daily CyberSecurity
IBM Db2 Mirror for i Hit by CVE-2026-17186 RCE Flaw (CVSS 9.9)
IBM patched 18 flaws in Db2 Mirror for i this week. The worst bug lets a remote attacker run system commands without logging in. IBM Db2 Mirror RCE risk reaches a CVSS score of 9.9. Also, several …
6 views
Daily Writeups
⤷ Title: CVE-2026 — 75855 : Path Traversal in ArcadeDB - Arbitrary File Write and Delete via Database Names
════════════════════════
𐀪 Author: Pervin Zahidli
════════════════════════
ⴵ Time: Thu, 20 Aug 2026 07:32:12 GMT
════════════════════════
⌗ Tags: #cybersecurity #application_security #cve #vulnerability #path_traversal
Medium
CVE-2026 — 75855 : Path Traversal in ArcadeDB - Arbitrary File Write and Delete via Database Names
ArcadeDB is a multi-model database engine with an HTTP server API. Like most database servers, it lets an admin create and drop databases…
12 views