[In] ShowDoc version before 2.8.7, an unrestricted and unauthenticated file upload issue is found and [an] attacker is able to upload a web shell and execute arbitrary code on server.
A hacker exploited a vulnerability within the Hyperbridge gateway smart contract, using a fabricated message to gain administrative privileges over the bridged DOT contract on Ethereum, triggering a transaction that generated 1 billion unauthorized tokens.