Vaahcms
Monthly
Embedded malicious JavaScript (a supply-chain backdoor) in VaahCMS 2.0.0-2.3.4 executes attacker-controlled code in any browser that renders the security-OTP Blade email template with JavaScript enabled, reported by VulnCheck and rated CVSS 4.0 9.2. The obfuscated payload opens a WebSocket to a hardcoded command-and-control endpoint, keylogs password fields via a MutationObserver, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the malicious code ships in the product itself, so exposure is inherent to running an affected version.
Embedded malicious JavaScript (a supply-chain backdoor) in VaahCMS 2.0.0-2.3.4 executes attacker-controlled code in any browser that renders the security-OTP Blade email template with JavaScript enabled, reported by VulnCheck and rated CVSS 4.0 9.2. The obfuscated payload opens a WebSocket to a hardcoded command-and-control endpoint, keylogs password fields via a MutationObserver, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the malicious code ships in the product itself, so exposure is inherent to running an affected version.