PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow

aikido.dev | research | #ai-security | #account-takeover | #xss | #cve | #ai-pentesting | #mailcow | #email-server
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

AI pentest agents found three XSS flaws in Mailcow, including one letting unauthenticated attackers hijack admin sessions—assigned CVE-2026-40872, CVE-2026-40873, and CVE-2026-40875.
Published
Collected

Related coverage

research · yokai.hakaisecurity.io
Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta
# Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta RESEARCHER **Pedro Cruz "gankd"** READ TIME**12 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Sumário ▸ Introdução ▸...
research · yokai.hakaisecurity.io
Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion
# Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion RESEARCHER **Pedro Cruz "gankd"** READ TIME**11 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Table of contents ▸...
research · ethiack.com
One-click RCE on OpenClaw in under 2 hours with an Autonomous Hacking Agent
Ethiack's Hackian agent found a one-click account-takeover-to-RCE chain in OpenClaw fully autonomously in under two hours, leaking the Gateway Control UI's auth token from an attacker-controlled site.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
research · bishopfox.com
Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research
CVE disclosures are up 85% while exploitation barely moved. Bishop Fox breaks down four Nginx CVEs that looked critical but rarely affect real deployments.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
Back