Archive
41 posts across 2 years · most active: 2026
2026
39 posts- Oct 27 the xray mod came with ads
- Oct 12 workspace asset download bypass in plane
- Sep 30 heap out-of-bounds read in pale moon cpal parser
- Sep 30 proton bridge logged its own vault key
- Sep 29 tor browser safer leaks wasm into file:// workers
- Sep 24 prefetch attacks
- Sep 20 dbus broadcast snooping through xdg-dbus-proxy
- Sep 13 cross-app builder privilege escalation in budibase
- Sep 11 LKS internal selection 2026 writeup
- Aug 18 local secrets store race in nextflow
- Aug 18 pinned plugin cache poisoning in nextflow
- Aug 18 i made $100 bypassing woocommerce coupon limits with draft orders
- Aug 02 cross-course submission comment and grade tampering in chamilo
- Aug 01 cross-course blog api authorization bypass in chamilo
- Jul 24 openam webauthn deserialization through a shallow filter
- Jul 24 turning a scoped vikunja token into a normal session
- Jul 03 cross-family access in churchcrm
- Jul 02 breaking shopper checkout from settings
- Jul 02 a tooltip xss in wikimedia charts
- Jun 24 a stored xss in silverstripe page breadcrumbs
- Jun 22 an idor in xibo notification export
- Jun 21 an ssrf in cloudreve through remote download
- Jun 21 a delete bypass in misp through crudcomponent
- Jun 21 an idor in winter fileupload
- Jun 17 bypassing pairip with manual modification
- Jun 17 a public link bug in invoiceshelf
- Jun 13 an event media authz bug in zoneminder
- Jun 10 a second-order ddns authz bug in nezha
- Jun 10 another sharp authz bug, this time in quick creation
- Jun 08 an idor in openproject through meeting agenda items
- Jun 05 two wallos cves from the same trust mistake
- May 25 a neat little cve in filament
- May 25 cross-tenant credential disclosure in itflow
- May 22 six cves in one open-source e-commerce project
- May 08 my first CVE, CVE-2026-44692
- Mar 10 how one cve turned into multiple csirt.go.id certs
- Feb 17 aseng forensic challs always give me a new insight
- Feb 07 the type of an ordinary ransomware challs
- Jan 30 LKS internal selection is very fun hahaha...
