Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

90+ Cryptocurrency Exchanges Were at Risk Because of One Outdated Library

hackenproof.com | blog | #cryptocurrency | #xss | #vulnerability | #dom-xss | #jquery | #exchanges | #tradingview

Summary

A DOM-based XSS in the TradingView Charting Library put 90+ crypto exchanges at risk—what the flaw did, how exchanges responded, and why the stakes are higher today
Published
Collected

original ↗

Related coverage

blog · hackenproof.com
90+ Cryptocurrency Exchanges are in Danger Because of the Outdated Library
HackenProof blog post warning that more than 90 cryptocurrency exchanges were exposed to risk because they embedded an outdated, vulnerable library in their platforms.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
blog · hackenproof.com
Global Crypto Regulations for Centralized Exchanges: EU, USA, Asia, Latin America & UAE Guide
A compliance map for centralized exchanges across the EU, US, Asia, Latin America and the UAE: MiCA, DORA, licensing and AML regimes, and why security testing now sits inside regulatory duties.
blog · bughunters.google.com
Enabling Trusted Types in a Complex Web Application: A Case Study of AppSheet
A Google case study on rolling out Trusted Types in AppSheet, covering how the team enforced DOM XSS protections in a complex production web application.
blog · portswigger.net
DOM Invader and the case of direct eval vs indirect eval
Gareth Heyes explains why DOM Invader can trigger eval exceptions: direct eval calls can access local scope variables, while indirect eval via a renamed reference runs in global scope and cannot.
blog · portswigger.net
Finding client-side prototype pollution with DOM Invader
DOM Invader has been upgraded to detect client-side prototype pollution (CSPP) in a couple of clicks. The post explains pollution sources, gadgets, and how the tool finds and exploits them.
back