Web Security Insights By Maloy Roy Orko

Hi All,  I am  Maloy Roy Orko . CVE Number: CVE-2025-0844 Recently in one of my pentest research, I found a Library-Card-System application By Needyamin which is an open source Library-Card-System to print a library card with student information using PHP, MYSQL, JAVASCRIPT. It is based on the scripting languages of PHP.  Library-Card-System  is a  Library-Card-S ystem using PHP, MYSQL, JAVASCRIPT Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of XSS Protection in  signup. php  file. It  can lead into : Malware Distribution Admin & User Account Takeover Data Breach Users Into Risk Reputation Damage The  Main Thing  Is, If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this . Title  of the ...

Hi All,  I am  Maloy Roy Orko . CVE Number: CVE-2025-0843 Recently in one of my pentest research, I found a Library-Card-System application By Needyamin which is an open source Library-Card-System to print a library card with student information using PHP, MYSQL, JAVASCRIPT. It is based on the scripting languages of PHP.  Library-Card-System  is a  Library-Card-S ystem using PHP, MYSQL, JAVASCRIPT Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of Proper Access Management  in  admindashboard.php  file. It  can lead into : Malware Distribution Unauthorized Access  Data Breach Web Shell Installation Reputation Damage The  Main Thing  Is, If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this ....

Hi All,  I am  Maloy Roy Orko . Recently in one of my pentest research, I found a Library-Card-System application By Needyamin which is an open source Library-Card-System to print a library card with student information using PHP, MYSQL, JAVASCRIPT. It is based on the scripting languages of PHP.  Library-Card-System  is a  Library-Card-S ystem using PHP, MYSQL, JAVASCRIPT Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of  SQL INJECTION Protection  in  admin.php  file. It  can lead into : Malware Distribution Data Breach Web Shell Installation Reputation Damage The  Main Thing  Is, If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this . Title  of the Vulnerability:  Library-Card-S...

Hi All,  CVE :  CVE-2025-0722 I am Maloy Roy Orko . Recently in one of my pentest research, I found an Image_Gallery application By Needyamin which is an open source Image Gallery Management System using PHP, MYSQL, JAVASCRIPT. It is based on the scripting languages of PHP. Image_Gallery is an Image gallery management system using PHP, MYSQL, JAVASCRIPT Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of File Extension or Upload protection In admin/ gallery.php file. It can lead into : Malware Distribution Remote Code Execution (RCE) Data Breach Denial of Service (DoS) Web Shell Installation Bypassing Security Controls Reputation Damage The Main Thing Is, If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this . Title of the Vulnerabi...

Hi All,  CVE :  CVE-2025-0721 I am  Maloy Roy Orko . Recently in one of my pentest research, I found an Image_Gallery application By Needyamin  which is an open source Image Gallery Management System using PHP, MYSQL, JAVASCRIPT. It is based on the scripting languages of PHP.  Image_Gallery  is an Image gallery management system using PHP, MYSQL, JAVASCRIPT Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of   Cross Site Scripting  protection. It can lead into Admin Account Takeover and Malicious JavaScript Codes Can Be Executed By Attackers Too. The Main Thing Is, if any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too .Thats why I am trying to inform everyone about this. Title of the Vulnerability:  Image_Gallery | view.php?username= | Cross Site...

He y All, I am  Maloy Roy Orko . Today,I'm going to show you that how you can install the LFISuite  LFI (Local File Inclusion) Exploitation Tool On Termux Android! What is LFISuite ? LFISuite is a totally automatic tool able to scan and exploit Local File Inclusion vulnerabilities using many different methods of attack, listed in the section Features. Features: Works with Windows, Linux and OS X Automatic Configuration Automatic Update Provides 8 different Local File Inclusion attack modalities:  /proc/self/environ php://filter php://input /proc/self/fd access log phpinfo data:// expect:// Provides a ninth modality, called Auto-Hack, which scans and exploits the target automatically by trying all the attacks one after the other without you having to do anything (except for providing, at the beginning, a list of paths to scan, which if you don't have you can find in this project directory in two versions, small and huge). Tor proxy support Reverse Shell for Windows, Lin...

H ey All, I am Maloy Roy Orko . Today,I'm going to show you that how you can install the CLI interface of Kali Linux On Termux Android! You can get little info on "Termux & Kali Linux" here...... So, Lets Go .... Perquisites: (1) Minimum 2 GB For Installation  (2) Non-rooted Android  (3) Minimum Version 8 (4) Stable Internet Connection  Steps: (1) GO to F-droid and install the latest version of Termux  Link:  https://f-droid.org/en/packages/com.termux / (2) Now, Type This Command! Commands: (1)  pkg update -y && pkg install wget curl proot tar -y && wget https://raw.githubusercontent.com/AndronixApp/AndronixOrigin/master/Installer/Kali/kali.sh -O kali.sh && chmod +x kali.sh && bash kali.sh (2) ./start-kali.sh Boom !! Kali Linux CLI Has Been Installed Successfully!  Now,You can use it by typing this command: ./start-kali.sh