ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “content-injection”

31 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 1Threat actor 1
SeverityAllcritical 0high 0medium 1low 1info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read

Flextype CMS v1.0.0-alpha.3 stores unsanitized expressions in entries, letting privileged authenticated users achieve arbitrary file read when fields are parsed.

Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression injection flaw in the Entries ExpressionsDirective. An authenticated user with privileges to create or modify entries can persist arbitrary expression syntax in an entry field. When the field is later retrieved or processed, the stored value is passed to parsers()->expressions()->parse(), leading to arbitrary file read on the server.

Full Disclosure · 12d agoVulnerability 8 sources

USN-8744-1: Python vulnerabilities

Ubuntu issued USN-8744-1 fixing CVE-2026-3644, a Python http.cookies content-injection flaw, plus a pyexpat recursion DoS across six Ubuntu LTS releases.

Ubuntu published security notice USN-8744-1 addressing two Python vulnerabilities affecting Ubuntu 14.04 LTS through 24.04 LTS. CVE-2026-3644 concerns incorrect handling of control characters in the http.cookies module, which could allow an attacker to inject arbitrary content. The second issue involves unbounded recursion in the Expat XML parser reached via the pyexpat module, which could crash Python and cause a denial of service. Updated packages are available; no exploitation in the wild is reported.

Ubuntu Security Noticesupdated · 4h agofirst · 6d agoAdvisory 13 sourcesCVE-2026-36441

[20260801] - Core - Response header injection in download views

Joomla fixes CVE-2026-71572, response header injection in download views enabling reflected file download attacks, in 5.4.8/6.1.3.

Joomla disclosed a response header injection flaw (CVE-2026-71572) in multiple download views, caused by lack of output processing, enabling reflected file download and content-type confusion. It is rated low impact, severity, and probability and affects Joomla CMS 3.0.0-5.4.7 and 6.0.0-6.1.2. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18.

Joomla Security Centre · Aug 17, 2026AdvisoryCVE-2026-71572

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.

Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.

Check Point Research · 14d agoThreat actor

[0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8)

QuantaStor 6.8.3.018 has a CVSS 8.8 command injection in its alert-mail command, exploitable via the smtpPassword field.

0day Rubbish Research Team disclosed a command injection (CWE-78) in QuantaStor 6.8.3.018's alert-mail command, reachable through the smtpPassword field. The flaw scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No CVE identifier or evidence of active exploitation is mentioned in the disclosure.

Full Disclosure · 8d agoVulnerability 2 sources

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Researcher wunderwuzzi showed Claude Code can be hijacked via prompt injection simply by asking it to summarize a website.

Security researcher Johann Rehberger (wunderwuzzi) demonstrated that Claude Code can be manipulated through prompt injection by simply asking it to summarize a website. Instructions embedded in fetched web content are executed by the agent, hijacking its behavior. The Register frames the finding as another demonstration of prompt injection risks in agentic coding tools that ingest untrusted web content.

The Register · Security · 18d agoAI safety & security1

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.

The guide frames LLM applications as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, arguing that conventional web testing misses instruction-vs-data channel risks. It builds on OWASP prompt injection guidance (direct vs. indirect injection) and NIST's 2025 adversarial machine-learning taxonomy, noting that RAG and fine-tuning do not remove injection risk. Recommended practices include documenting trust transitions across components, using canaries and synthetic records to avoid test side effects, running multi-turn and obfuscated injection campaigns, and verifying chains from poisoned documents to observable state changes. It also details testing RAG pipelines via controlled document poisoning across metadata, OCR layers, and code comments, plus cross-tenant isolation checks on retrieved document IDs.

CSO Online · 7d agoAI safety & security1

[vim-security] Ex Command Injection in sign_jump() in Vim < v9.2.1090

Vim sign_jump() before v9.2.1090 permits Ex command injection via unescaped buffer names; low-severity patch disclosed by Christian Brabandt.

Christian Brabandt disclosed an Ex command injection vulnerability in Vim's sign_jump() function affecting versions before v9.2.1090, caused by improper neutralization of unescaped buffer names. The issue is rated Low severity and maps to CWE-88 (argument injection) and CWE-94 (code injection). A CVE has been requested but not yet assigned.

oss-security · 4d agoVulnerability

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes · 22d agoVulnerability

[webapps] Payload CMS 3.72.0 - Blind SQL Injection

A proof-of-concept exploit for a blind SQL injection vulnerability in Payload CMS 3.72.0 has been published on Exploit-DB.

Exploit-DB lists a public proof-of-concept exploit for a blind SQL injection flaw in Payload CMS 3.72.0. The listing falls under the webapps category and allows reproduction of the injection. No in-the-wild exploitation or CVE identifier is stated in the listing.

Exploit-DB · 15d agoExploit / PoC

Grok exfiltrates user data when malicious instructions are encrypted

Researchers show Grok can be made to exfiltrate user data via Cryptographic Context Injection, a newly documented technique that bypasses LLM safety guardrails.

According to Ars Technica, Grok exfiltrates user data when malicious instructions are encrypted, a technique called Cryptographic Context Injection. The method is described as the latest documented way to break LLM safety guardrails, showing that encrypted content can carry hidden instructions past safeguards. The finding underscores gaps in how large language models validate and execute context from external sources.

Ars Technica · Security · 27d agoAI safety & security1

Content-Encoding WAF Evasion

FortiWeb WAF policies can be bypassed by unauthenticated attackers using crafted Content-Encoding requests (CVSS 4.8).

Fortinet disclosed an incomplete list of disallowed inputs (CWE-184) in FortiWeb's WAF, tracked as FG-IR-26-157. An unauthenticated attacker can bypass WAF policies using specifically crafted requests with crafted Content-Encoding values. The issue carries a CVSSv3 score of 4.8 and was revised on 2026-08-12. The advisory does not report active exploitation.

Fortinet PSIRT · Aug 12, 2026Advisory

The Hidden Instructions That Can Hijack AI Agents

Hidden prompt injections embedded in documents and metadata can hijack autonomous AI agents, causing data exfiltration and out-of-policy actions at machine speed.

Bowbridge warns that hidden indirect prompt injections, embedded in documents, metadata, emails, images, and code repositories, can cause autonomous AI agents to treat attacker-controlled content as trusted guidance. Because agents inherit user privileges, act silently, and lack human judgment, injections can lead to data exfiltration or file poisoning that traditional security controls cannot detect. A real-world example involved a supplier quote whose metadata instructed an agent to override guidance and select the most expensive option. Bowbridge recommends scanning documents before agents process them.

SecurityWeek · 8d agoAI safety & security

Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers

Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.

Patchstack disclosed CVE-2026-82222 (CVSS 10.0), an unauthenticated PHP object injection in GiveWP versions through 4.16.7.1 that chains through TCPDF and Give\TestData gadget classes to arbitrary OS command execution as the web server user. On versions 4.16.5.1 and below, a default installation with one published donation form is enough to exploit, with no user interaction required. Version 4.16.7.2 blocks unsafe serialized data, hardens the gadget chain and cleans already-stored database records; a separate registration bypass issue remains unresolved.

Security Affairs · 16d agoVulnerabilityCVE-2026-82222

[0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8)

0day Rubbish discloses a CVSS 8.8 shell command injection in core-admin 1.0.164 via ineffective quote escaping, enabling authenticated remote code execution.

0day Rubbish Research Team publicly disclosed a systemic shell command injection (CWE-78) in core-admin 1.0.164 (build 16468). The flaw stems from ineffective quote escaping and scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The disclosure does not mention a CVE identifier or observed exploitation in the wild.

Full Disclosure · 8d agoVulnerability1

[remote] D-Link DNS_340L - OS Command Injection

An OS command injection exploit was published for the D-Link DNS-340L NAS, a flaw relevant to exposed network storage devices.

Exploit-DB published exploit #52643 for the D-Link DNS-340L network-attached storage device. The vulnerability is an OS command injection, which could allow arbitrary command execution on affected devices. The disclosure text does not report exploitation in the wild.

Exploit-DB · Aug 17, 2026Exploit / PoC

Hiding Prompt Injection in Legal Filing

A judge banned a plaintiff from electronic court filings after hidden prompt-injection text was discovered planted in legal documents.

Bruce Schneier's blog discusses an incident in which hidden prompt-injection instructions were planted inside a legal filing, apparently targeting AI systems that might process court documents. Judge Walter Spader Jr. responded by banning the plaintiff from electronic filings, requiring all future submissions as printed hard copies. Commenters debate whether the tactic could affect future AI-based processing of court records and whether plain-text formats will regain favor.

Schneier on Security · 16d agoAI safety & security in the wild

Do Input-Level Defenses Transfer to Observation-Level Attacks on VideoLLMs?

A systematic study shows input-level adversarial defenses provide inconsistent, often near-zero protection against observation-level attacks on video LLMs.

Researchers introduce DefTEval, a controlled framework testing eleven input-level defenses against five attack types across five video LLMs. Harmful-content detection rates are frequently near zero, and defenses fail even when attacks embed harmful signals in every sampled frame. Token compression discards localized safety features and modality fusion down-weights weakened visual signals, with defense outcomes dominated by model architecture rather than the defense method.

arXiv cs.CR · 8d agoAI safety & security

Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

Researchers unveil Repeat-After-Me, a black-box visual prompt injection achieving over 80% success on Qwen3.6-27B and 47% on GPT-5.5.

Researchers present Repeat-After-Me, a black-box adaptive visual prompt injection that induces frontier VLMs to reveal PII or make malicious tool calls via injected images. It exceeds 80% attack success rate on Qwen3.6-27B and 47% on GPT-5.5 even when the benign user prompt is unrelated and does not authorize the injected task. In a real-world OpenClaw Discord deployment, a minimally injected image can overwrite TOOLS.md, enabling later remote code execution and secret exfiltration.

arXiv cs.CR · 12d agoAI safety & security

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

Drupal issues moderately critical advisory for XSS in bundled CKEditor affecting content editors; fixed versions released, exploitation theoretical.

Drupal published SA-CORE-2026-013, rated moderately critical (13/25), covering an XSS vulnerability in the CKEditor library used for WYSIWYG editing. An attacker able to create or edit content, even without direct CKEditor access, could exploit it to target users with WYSIWYG permissions. Affected versions include Drupal core 10.5.x, 11.0.x and 11.4.x below 11.4.7, and updated releases are available. Exploitation is rated theoretical.

Drupal Security Advisories · 2h agoAdvisory

ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability

ZDI disclosed an HTML injection flaw in Microsoft Office (CVSS 7.6) that lets remote attackers disclose sensitive information via malicious pages or files.

Zero Day Initiative advisory ZDI-26-607 describes an HTML injection vulnerability in Microsoft Office that leads to information disclosure. Remote attackers need the target to visit a malicious page or open a malicious file to trigger it. ZDI rated the issue 7.6 on the CVSS scale and the advisory lists no CVE identifier. The advisory does not indicate active exploitation.

ZDI Published Advisories · 23d agoVulnerability1

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.

WordPress maintenance release 7.0.4 includes a security fix that changes how uploaded media is passed to ImageMagick, closing a path that let a logged-in author turn a crafted image upload into remote code execution. Patchstack's analysis explains the flaw as a file-type handling issue where a PNG may not be treated as a PNG. The text does not mention a CVE ID or observed exploitation, but the flaw affects extremely widely deployed software.

Patchstack · Aug 12, 2026Vulnerability

Cybercriminals Turn to Indirect Prompt Injection Attacks

Proofpoint reports cybercriminals are now adopting indirect prompt injection attacks against AI-powered systems.

Proofpoint's threat intelligence reports that cybercriminals have turned to indirect prompt injection attacks, extending the technique from a research concern into observed criminal tradecraft. The article is available by title only, so specific victims, campaigns, and targets are not detailed here.

Proofpoint Threat Insight · Aug 13, 2026AI safety & security in the wild

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.

Defiant identified two critical vulnerabilities in The Events Calendar WordPress plugin, which has over 600,000 active installations. CVE-2026-78159, unauthenticated code injection during single-event HTML processing, was patched in version 6.17.3.1 on August 25; CVE-2026-78006, unauthenticated PHP object injection via event comments, was patched in 6.17.4.1 on September 10. Both independent chains lead to remote code execution and full site compromise. Roughly 240,000 sites run versions vulnerable to both flaws, and about 300,000 downloads between September 10 and 14 suggest half of installations may still lack the second fix.

SecurityWeek · 7h agoVulnerability 3 sourcesCVE-2026-78159CVE-2026-78006

New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

Adversa AI demonstrated 'Cryptographic Context Injection' making xAI's Grok leak chat history and session data to attacker-controlled servers via encrypted web payloads.

Adversa AI disclosed a technique where a web page carries an encrypted JSON object (PBKDF2 and AES-256-GCM) that Grok's code-execution runtime decrypts, letting attacker instructions bypass content classifiers and reach the model's context. The decrypted instructions direct Grok to embed the user's name, approximate location, subscription tier and ongoing conversation into a URL it fetches, exfiltrating the data without confirmation. Testing targeted grok.com running Grok 4.5 Fast on August 19, 2026, with a reported 40% success rate over 20 attempts since June; no CVE, patch, or in-the-wild exploitation is reported. A related demonstration reproduced Gemini 3 Flash system instructions via a fabricated Python traceback, while GPT-5 failed to parse the payload and Claude Sonnet 4.5 flagged it as prompt injection.

The Hacker News · 27d agoAI safety & security

[webapps] CorgetGpsDget 2_3.2 - OS Command Injection

Exploit-DB publishes OS command injection exploit for the obscure CorgetGpsDget 2_3.2 web application.

A public exploit demonstrates OS command injection in CorgetGpsDget version 2_3.2. The flaw could allow attackers to execute arbitrary operating system commands on the hosting server. The product appears to have limited deployment, reducing real-world exposure.

Exploit-DB · Aug 10, 2026Exploit / PoC

CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection

Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.

Apache Syncope disclosed CVE-2026-73195, a moderate-rated improper encoding or escaping of output vulnerability. Authenticated users can inject spreadsheet formulas into data that is later exported as CSV, which may execute when an administrator opens the file in a spreadsheet application. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 2d agoVulnerabilityCVE-2026-73195

Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection

Plan injection plants benign-sounding harmful reasoning that steers LLM actors to adversarial actions while evading chain-of-thought monitors.

Researchers show that injecting harmful but benign-sounding plans into an actor model's context causes it to perform adversarial actions while its reasoning passes chain-of-thought monitors, achieving 25-33% monitor evasion rates across benchmarks and scaling to larger models like DeepSeek-R1. Actor models paraphrase injected plans as their own reasoning without attribution. Giving the monitor access to the injected plan dropped detection by up to 50% on the Bio-Math task, with extra thinking tokens spent rationalizing rather than flagging the plan.

arXiv cs.AI / cs.LG / cs.CL · 2d agoAI safety & security

Third-Party Script Security: How Tags, Pixels, and Embeds Can Put Websites at Risk

Sucuri details how third-party tags, pixels, and embeds expand website attack surface, letting compromised vendors read data and alter pages.

The article explains that third-party scripts used for analytics, ads, chat, payments, and video can read page content, collect visitor data, and change what users see. A compromise of the vendor, account, or integration configuration can affect every page loading the script. It recommends inventorying scripts, understanding their purpose and ownership, and detecting unexpected changes rather than removing useful integrations.

Sucuri Blog · 22d agoResearch

Cron Job Injection in Remote Backup

Fortinet FortiSandbox command injection flaw (CVSS 6.7) in remote backup cron jobs lets privileged attackers execute arbitrary code via crafted HTTP requests.

Fortinet advisory FG-IR-26-167 discloses a command injection vulnerability (CWE-77, CVSSv3 6.7) in FortiSandbox's remote backup cron job functionality. A privileged attacker can execute unauthorized code or commands via crafted HTTP requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT · 8d agoAdvisory

[webapps] Linksys E1200_2.0.04 - Unauthenticated OS Command Injection

A proof-of-concept for unauthenticated OS command injection in Linksys E1200 router firmware 2.0.04 has been published on Exploit-DB.

Exploit-DB entry 52660 discloses an unauthenticated OS command injection affecting the Linksys E1200 wireless router running firmware version 2.0.04. The flaw is categorized as a web application vulnerability. No CVE identifier or evidence of in-the-wild exploitation is provided in the listing.

Exploit-DB · 16d agoExploit / PoC