XSS Vulnerability Patched in Open-Source OSINT Tool Cyberbro

·1 views

A high-severity Cross-Site Scripting (XSS) flaw was discovered and fixed in Cyberbro, an open-source OSINT platform with over 120 GitHub stars. The vulnerability existed in the search highlight feature of SearchView.js, where unsanitized user input was passed directly into the DOM via .innerHTML, enabling reflected XSS attacks. Any unauthenticated user could trigger the exploit with a single click, potentially allowing attackers to execute malicious JavaScript, hijack sessions, or steal credentials. The flaw, rated CVSS 7.5 and classified under CWE-79 and OWASP Top 10 A03:2021, was detected by GSC, a self-learning static analysis security tool. The fix replaced unsafe .innerHTML assignment with programmatic DOM element creation, and the corresponding pull request was reviewed and merged by the project maintainer.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Terraform, AWS CDK, or CloudFormation: How to Pick the Right IaC Tool in 2026

AWS teams building cloud infrastructure must choose between three main Infrastructure as Code tools: CloudFormation, AWS CDK, and Terraform, each suited to different needs. CloudFormation is AWS-native, requires no state management, and offers same-day support for new AWS services, but is verbose and limited to AWS resources. AWS CDK lets developers write infrastructure in familiar languages like TypeScript or Python, offering reusable constructs and type safety, though it still compiles down to CloudFormation. Terraform supports over 4,000 providers across multiple clouds and has a large module ecosystem, but requires teams to manage their own state files. Experts advise against switching tools frequently, recommending migration only when the current tool is actively blocking progress, such as a new multi-cloud requirement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PULP Engine Uses Zero-Allocation Hot Paths to Handle Millions of Log Events Per Second

A native Windows telemetry engine called PULP has been designed in C11 to process high-volume logs at tens of millions of events per second on standard hardware. The system eliminates dynamic memory allocations on its ingestion hot path entirely, pre-allocating all memory pools at startup to avoid non-deterministic latencies. Incoming structured events are converted into fixed 32-byte cache-aligned binary records, each fitting within half a standard 64-byte L1 CPU cache line to maximize memory bus efficiency. To avoid lock contention during multi-core scaling, each worker thread maintains its own isolated dictionary table using a multi-hash cascade strategy instead of shared global structures. The architecture also forgoes traditional LRU eviction mechanisms, which require access-order tracking, in favor of an evictionless design that preserves throughput.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenRouter Offers Single API Key Access to 300+ AI Models at Provider Prices

OpenRouter is a unified API gateway that lets developers access over 300 large language models from providers like Anthropic, OpenAI, Google, Meta, and DeepSeek using a single API key and credit balance. Users can switch between models by changing one parameter, with no new integrations or separate billing accounts required. The platform is compatible with the OpenAI SDK, meaning existing code requires only a base URL and API key change to work. OpenRouter charges a flat 5.5% fee on credit purchases and passes through provider token prices at cost, replacing an older per-token markup model. Free accounts receive up to 50 requests per day, with access to roughly 29 free models including Llama 3, Gemma 4, and DeepSeek Flash for prototyping purposes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How CatBoost Prevents Data Leakage Using Ordered Target Statistics

CatBoost, a gradient boosting library, addresses a common flaw in tabular machine learning called target leakage, where encoding a categorical feature with the mean target value inadvertently feeds the model the answer it is trying to predict. Standard target encoding can make a feature with no real signal appear highly predictive during training, yet perform five times worse on unseen test data. CatBoost's solution, called ordered target statistics, ensures that when encoding a row's category, only rows that appeared earlier in the dataset are used to compute the mean — never future rows. This chronological restriction mirrors a principle of fair auditing: a translator should only know what was recorded before the moment being interpreted, not the final verdict. The result is a model that generalises honestly to new data rather than one that has quietly memorised the outcome through leaked information.

0 comments Read more at DEV Community