/
ttps_attack:T1204.001 × criticity:medium × limpar

Resultados

2 casos · pág. 1/1

yokai.hakaisecurity.io · medium

Client-Side Path Traversal chains in bug bounty targets enable stored XSS, account takeover and account deletion

Researcher Pedro Cruz (gankd) documents two Client-Side Path Traversal (CSPT) chains found in production bug bounty programs. The first turns CSPT into Stored XSS and account takeover on a payments platform's Angular POS single-page application. The second, found with Felipe Torres, triggers unauthorized account deletion on one of the lar…

financial services e-commerce
hacktron.ai · medium

Cluely Electron app flaw: missing will-navigate guard and open IPC bridge enable silent screen and mic capture, with a path to RCE

Researchers at Hacktron disclosed a vulnerability chain in Cluely, an Electron-based AI assistant that reads the user's screen and microphone. They found it in July 2025 and published in February 2026. The main window had no will-navigate handler, so a link in the AI's markdown response could navigate the whole app to an attacker-controll…

technology