# Research

> Vulnerabilities and malware found by HackIndex, with affected versions and fixes.

- **URL:** https://hackindex.io/research

- [Broken Access Control in AI OpenRouter Gateway: CVE Research](https://hackindex.io/research/broken-access-control-in-ai-openrouter-gateway.md): A Filament gateway documents a config option to lock down its admin UI, but nothing in the code ever reads it. Any authenticated panel user reaches the full gateway: API tokens, system prompts, model settings and telemetry. Tracked as GHSA-57hh-5c98-83r8.
- [Unauthenticated Settings Overwrite in WooCommerce Multistore: CVE Research](https://hackindex.io/research/unauthenticated-settings-overwrite-woocommerce-multistore.md): Exploit WooCommerce Multistore 5.4.7 unauth settings overwrite via curl POST to admin-ajax.php. Fake nonce, stock zeroing, SQLi via predictable key=1
- [Infinite Loop svg2pdf.js CSS Selectors: CVE Research](https://hackindex.io/research/infinite-loop-svg2pdf-selectors-unbounded-splitting.md): svg2pdf.js 2.7.0 and earlier: an empty quoted string in a CSS selector triggers an unrecoverable infinite loop (CWE-835). Analysis, PoC and patch.
- [Stored XSS Filament Comments: CVE Research (CVE-2026-90943)](https://hackindex.io/research/stored-xss-filament-comments-unescaped-rendering.md): Stored XSS filament comments: unescaped HTML rendering lets any user execute JavaScript in admin sessions. PoC and fix included.
- [Picture in Picture Adware: The Chrome Tab Hijack](https://hackindex.io/research/picture-in-picture-adware.md): How a 200,000-user Chrome extension turned into Picture in Picture adware: a hidden tab on every update, traced end to end with IOCs.
- [ModHeader Malware: Inside the Chrome Spyware Google Removed](https://hackindex.io/research/modheader-malware-chrome-spyware.md): This ModHeader malware analysis reverses the Chrome extension Google pulled and uncovers dormant, encrypted domain-harvesting spyware. Full teardown inside.