{
  "$schema": "https://jankesec.com/schemas/threat-intel-v1.json",
  "meta": {
    "generator": "jankesec CTI & Vulnerability Feed",
    "site": "https://jankesec.com",
    "author": "Sevban Dönmez",
    "contact": "https://jankesec.com/disclosure/",
    "securityTxt": "https://jankesec.com/.well-known/security.txt",
    "generatedAt": "2026-09-01T22:38:53.634Z",
    "counts": {
      "researchRecords": 8,
      "creditedCves": 4
    }
  },
  "research": [
    {
      "id": "root-namespace-load-detection",
      "title": "Calibrating a Root-Namespace Load Detector",
      "description": "I ended a CVE-2025-32463 write-up with a recommendation and never carried it out. This is what happened when I built the instrument to do it: an inert marker running as root, two detection layers that had to be redesigned mid-flight, and three ways the measurement lies to you.",
      "cves": [
        "CVE-2025-32463"
      ],
      "vendor": "Sudo Project",
      "product": "sudo",
      "affectedVersions": "1.9.14 through 1.9.17",
      "fixedVersions": "1.9.17p1",
      "weaknesses": [
        "CWE-829"
      ],
      "platform": "Linux",
      "validation": "Lab Reproduced",
      "confidence": "High",
      "severity": "High",
      "analysisType": "Variant Analysis",
      "publishedDate": "2026-08-30T18:30:00.000Z",
      "updatedDate": null,
      "sourceReviewedAt": "2026-08-30T00:00:00.000Z",
      "url": "https://jankesec.com/research/root-namespace-load-detection/",
      "rawMarkdown": "https://jankesec.com/research/root-namespace-load-detection.md"
    },
    {
      "id": "android-package-name-forgery-cve-2024-0044",
      "title": "CVE-2024-0044: How Installer Metadata Forged an Android App Identity",
      "description": "A reader-first variant analysis of Android CVE-2024-0044: how a crafted installer name could corrupt packages.list, mislead run-as, and why the first fix needed a follow-up.",
      "cves": [
        "CVE-2024-0044"
      ],
      "vendor": "Google",
      "product": "Android Framework Package Installer and run-as",
      "affectedVersions": "Android 12, 12L, 13, 14, and 15 before the applicable October 2024 platform fix",
      "fixedVersions": "Android security patch level 2024-10-01 or later, with the applicable device branch patch",
      "weaknesses": [
        "CWE-75"
      ],
      "platform": "Android",
      "validation": "Static Reproduction",
      "confidence": "High",
      "severity": "High",
      "analysisType": "Variant Analysis",
      "publishedDate": "2026-08-26T22:15:00.000Z",
      "updatedDate": null,
      "sourceReviewedAt": "2026-08-27T00:00:00.000Z",
      "url": "https://jankesec.com/research/android-package-name-forgery-cve-2024-0044/",
      "rawMarkdown": "https://jankesec.com/research/android-package-name-forgery-cve-2024-0044.md"
    },
    {
      "id": "apple-webkit-orphaned-stylesheet-cve-2025-31205",
      "title": "CVE-2025-31205: How a Detached Stylesheet Exposed Cross-Origin Data",
      "description": "A reader-first analysis of CVE-2025-31205: how JavaScript kept a cross-origin stylesheet alive after detachment, why WebKit treated missing ownership as permission, and how the fix fails closed.",
      "cves": [
        "CVE-2025-31205"
      ],
      "vendor": "Apple",
      "product": "WebKit",
      "affectedVersions": "Safari before 18.5 and corresponding Apple platform releases; WebKitGTK and WPE WebKit before 2.48.2",
      "fixedVersions": "Safari 18.5; iOS and iPadOS 18.5; macOS Sequoia 15.5; WebKitGTK and WPE WebKit 2.48.2",
      "weaknesses": [
        "CWE-352"
      ],
      "platform": "Apple",
      "validation": "Static Reproduction",
      "confidence": "High",
      "severity": "High",
      "analysisType": "Variant Analysis",
      "publishedDate": "2026-08-24T11:00:00.000Z",
      "updatedDate": null,
      "sourceReviewedAt": "2026-08-24T00:00:00.000Z",
      "url": "https://jankesec.com/research/apple-webkit-orphaned-stylesheet-cve-2025-31205/",
      "rawMarkdown": "https://jankesec.com/research/apple-webkit-orphaned-stylesheet-cve-2025-31205.md"
    },
    {
      "id": "sudo-chroot-nss-cve-2025-32463",
      "title": "CVE-2025-32463: How a User-Controlled Chroot Loaded Code as Root",
      "description": "A reader-first root-cause analysis of CVE-2025-32463: how sudo entered an attacker-controlled filesystem before authorization completed, why NSS could then load a library as root, and what 1.9.17p1 changed.",
      "cves": [
        "CVE-2025-32463"
      ],
      "vendor": "Sudo Project",
      "product": "sudo",
      "affectedVersions": "1.9.14 through 1.9.17",
      "fixedVersions": "1.9.17p1",
      "weaknesses": [
        "CWE-829"
      ],
      "platform": "Linux",
      "validation": "Static Reproduction",
      "confidence": "High",
      "severity": "High",
      "analysisType": "Root Cause Analysis",
      "publishedDate": "2026-08-23T09:00:00.000Z",
      "updatedDate": null,
      "sourceReviewedAt": "2026-08-24T00:00:00.000Z",
      "url": "https://jankesec.com/research/sudo-chroot-nss-cve-2025-32463/",
      "rawMarkdown": "https://jankesec.com/research/sudo-chroot-nss-cve-2025-32463.md"
    },
    {
      "id": "apple-webkit-primitive-restart",
      "title": "CVE-2025-24201: How Web Content Reached an Unneeded GPU State",
      "description": "A reader-first reconstruction of Apple's CVE-2025-24201 WebKit fix: what the sandbox-escape advisory says, what primitive restart means, and what the public patch proves without inventing the private exploit chain.",
      "cves": [
        "CVE-2025-24201"
      ],
      "vendor": "Apple",
      "product": "WebKit",
      "affectedVersions": "Safari before 18.3.1; platform scope per Apple advisory",
      "fixedVersions": "Safari 18.3.1 and corresponding Apple security updates",
      "weaknesses": [
        "CWE-787"
      ],
      "platform": "Apple",
      "validation": "Static Reproduction",
      "confidence": "High",
      "severity": "High",
      "analysisType": "Patch Analysis",
      "publishedDate": "2026-08-23T00:00:00.000Z",
      "updatedDate": null,
      "sourceReviewedAt": "2026-08-24T00:00:00.000Z",
      "url": "https://jankesec.com/research/apple-webkit-primitive-restart/",
      "rawMarkdown": "https://jankesec.com/research/apple-webkit-primitive-restart.md"
    },
    {
      "id": "php-cgi-best-fit-cve-2024-4577",
      "title": "CVE-2024-4577: How Windows Reopened PHP-CGI Command Injection",
      "description": "A reader-first variant analysis of CVE-2024-4577 and CVE-2024-8926: how Windows character conversion turned safe-looking query input into PHP-CGI options and why the first fix needed a follow-up.",
      "cves": [
        "CVE-2024-4577",
        "CVE-2024-8926"
      ],
      "vendor": "PHP Group",
      "product": "PHP-CGI on Windows",
      "affectedVersions": "Before 8.3.8 / 8.2.20 / 8.1.29; some configurations remained affected until the September 2024 releases",
      "fixedVersions": "8.3.12 / 8.2.24 / 8.1.30 or later",
      "weaknesses": [
        "CWE-78"
      ],
      "platform": "Windows",
      "validation": "Static Reproduction",
      "confidence": "High",
      "severity": "Critical",
      "analysisType": "Variant Analysis",
      "publishedDate": "2026-02-19T08:00:00.000Z",
      "updatedDate": null,
      "sourceReviewedAt": "2026-08-24T00:00:00.000Z",
      "url": "https://jankesec.com/research/php-cgi-best-fit-cve-2024-4577/",
      "rawMarkdown": "https://jankesec.com/research/php-cgi-best-fit-cve-2024-4577.md"
    },
    {
      "id": "openssh-signal-race-cve-2024-6387",
      "title": "CVE-2024-6387: How an OpenSSH Timeout Could Lead to Remote Root Access",
      "description": "A clear reconstruction of regreSSHion: how an unauthenticated connection triggered unsafe signal-time logging in sshd, why that could corrupt the heap, which systems were exposed, and how OpenSSH 9.8p1 fixed the root cause.",
      "cves": [
        "CVE-2024-6387"
      ],
      "vendor": "OpenSSH Project",
      "product": "Portable OpenSSH sshd",
      "affectedVersions": "8.5p1 through 9.7p1 on affected platforms",
      "fixedVersions": "9.8p1 or a vendor-confirmed backport",
      "weaknesses": [
        "CWE-364"
      ],
      "platform": "Linux",
      "validation": "Static Reproduction",
      "confidence": "High",
      "severity": "Critical",
      "analysisType": "Root Cause Analysis",
      "publishedDate": "2025-09-18T08:00:00.000Z",
      "updatedDate": null,
      "sourceReviewedAt": "2026-08-28T00:00:00.000Z",
      "url": "https://jankesec.com/research/openssh-signal-race-cve-2024-6387/",
      "rawMarkdown": "https://jankesec.com/research/openssh-signal-race-cve-2024-6387.md"
    },
    {
      "id": "xz-utils-release-artifact-cve-2024-3094",
      "title": "CVE-2024-3094: How a Backdoored XZ Release Reached OpenSSH",
      "description": "A clear reconstruction of the XZ Utils supply-chain attack: what was changed, how malicious release tarballs altered liblzma, why selected OpenSSH servers became reachable, and which systems were actually exposed.",
      "cves": [
        "CVE-2024-3094"
      ],
      "vendor": "Tukaani Project",
      "product": "XZ Utils / liblzma",
      "affectedVersions": "Malicious 5.6.0 and 5.6.1 release tarballs",
      "fixedVersions": "5.6.2 or a vendor-confirmed unaffected build",
      "weaknesses": [
        "CWE-506"
      ],
      "platform": "Linux",
      "validation": "Static Reproduction",
      "confidence": "High",
      "severity": "Critical",
      "analysisType": "Root Cause Analysis",
      "publishedDate": "2025-03-27T08:00:00.000Z",
      "updatedDate": null,
      "sourceReviewedAt": "2026-08-24T00:00:00.000Z",
      "url": "https://jankesec.com/research/xz-utils-release-artifact-cve-2024-3094/",
      "rawMarkdown": "https://jankesec.com/research/xz-utils-release-artifact-cve-2024-3094.md"
    }
  ],
  "cves": [
    {
      "id": "CVE-2025-6577",
      "title": "SQL Injection (SQLi)",
      "description": "An Improper Neutralization of Special Elements used in an SQL Command vulnerability (CWE-89) allowing SQL Injection in Akıllı Ticaret's E-Commerce Website. Affects versions before 4.5.001. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
      "target": "Akıllı Ticaret E-Commerce Website",
      "cwe": "CWE-89",
      "severity": "Critical",
      "cvssScore": 9.8,
      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "credit": "Sevban Alp DÖNMEZ",
      "date": "2026-05-12",
      "url": "https://jankesec.com/cves/2025-6577/"
    },
    {
      "id": "CVE-2025-4764",
      "title": "SQL Injection (SQLi)",
      "description": "An Improper Neutralization of Special Elements used in an SQL Command vulnerability (CWE-89) in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows SQL Injection. The CVE record marks versions through 22012026 as affected and notes that the vendor did not respond to the coordinated disclosure. NVD scores the issue 8.8 with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the original TR-CERT CNA assessment of 8.0 remains preserved on the detail page.",
      "target": "Aida Computer Hotel Guest Hotspot",
      "cwe": "CWE-89",
      "severity": "High",
      "cvssScore": 8.8,
      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "credit": "Sevban DÖNMEZ",
      "date": "2026-01-22",
      "url": "https://jankesec.com/cves/2025-4764/"
    },
    {
      "id": "CVE-2025-7743",
      "title": "Cleartext Transmission of Sensitive Information",
      "description": "A Cleartext Transmission of Sensitive Information vulnerability (CWE-319) in Dolusoft Omaspot allows interception and privilege escalation. Affects versions before 12.09.2025. CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.",
      "target": "Dolusoft Omaspot",
      "cwe": "CWE-319",
      "severity": "Critical",
      "cvssScore": 9.6,
      "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "credit": "Sevban Donmez",
      "date": "2025-09-16",
      "url": "https://jankesec.com/cves/2025-7743/"
    },
    {
      "id": "CVE-2025-7744",
      "title": "SQL Injection (SQLi)",
      "description": "An Improper Neutralization of Special Elements used in an SQL Command vulnerability (CWE-89) allowing SQL Injection in Dolusoft Omaspot. Affects versions before 12.09.2025. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.",
      "target": "Dolusoft Omaspot",
      "cwe": "CWE-89",
      "severity": "Critical",
      "cvssScore": 9.8,
      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "credit": "Sevban Donmez",
      "date": "2025-09-16",
      "url": "https://jankesec.com/cves/2025-7744/"
    }
  ]
}