Security Research
CVE-2024-10793 is a stored XSS flaw in WP Activity Log 5.2.1 and below, CVSS 7.2. Attackers POST unfiltered log entries via admin-ajax.php; when an admin views the log page the XSS fires, steals a nonce, and uploads a PHP webshell to reach RCE. The audit page treats the log database as a trusted render plane, and the write path accepts HTML fragments from any authenticated subscriber. The exploit follows a simple chain: insert payload, wait for admin to view log, run injected script under the admin origin, abuse WordPress nonce to authorize a plugin upload, drop a PHP shell. The audit trail is exactly where least-privilege XSS is most expensive.
2024-12-25
3 min
#Vulnerability Analysis
Security Research
CVE-2024-10793 is a stored XSS flaw in WP Activity Log before 5.2.1, CVSS 7.2. An attacker injects unsanitized log entries via admin-ajax.php; when an admin opens the activity log panel, the XSS fires and chains nonce theft with plugin upload to drop a PHP Webshell, escalating anonymous XSS to RCE. The render plane for the activity log trusts whatever the write path hands over, and the write path accepts HTML fragments from any subscriber-level user. The fix mirrors the same pattern: sanitize at the write path, escape at the render path, and never mix user-supplied data with the trusted admin context. The chain also reveals why low-privilege XSS still matters: the admin browser is the most privileged context on the site.
2024-12-19
3 min
#Vulnerability Analysis
Security Research
lunary-ai/lunary versions before 1.6.7 carry three CVEs in one release line: CVE-2024-10273 Stored XSS in SAML metadata, CVE-2024-11137 IDOR in the PATCH /v1/runs/:id/score endpoint, and CVE-2025-0281 privilege escalation in PATCH /v1/models/:id. Each one lives in a different surface area, yet every root cause points to the same consistency gap: the platform treats authentication as equivalent to authorization. The SAML parser keeps attacker-controlled script nodes; the score endpoint only checks the project's owner, ignoring whether the requester is the project itself; the model endpoint omits a project-id check. The fix is twofold: sanitize the SAML metadata through an allowlist parser, and centralize the project membership check. The lesson generalizes: every authenticated route must answer both 'who are you' and 'what can you touch'.
2024-12-19
8 min
#Vulnerability Analysis
Security Research
CVE-2024-52875 is a CRLF injection in Kerio Control 9.2.5 to 9.4.5, CVSS 8.8. An attacker crafts a request with CRLF characters to inject HTTP headers, and with social engineering to make an admin click the link, achieves 1-click RCE and full firewall control. CRLF characters in user input should never survive into a header line; the firewall's admin web interface forgets that rule, and a redirect parameter becomes the entry point. The exploit chain runs response splitting, cookie injection, then a script body that calls the firewall's own API. The lesson is that 1-click does not mean low impact: a single admin click on a phishing message compromises the entire gateway.
2024-12-16
5 min
#Vulnerability Analysis
Security Research
CVE-2024-46982 is a cache poisoning vulnerability in Next.js 13.5.1 to 14.2.9.2, CVSS 7.5. Non-dynamic SSR pages do not isolate user-specific data at the cache layer. An attacker poisons the cache by injecting a malicious Host header, and subsequent users receive the poisoned response, leading to XSS or credential theft. The cache key omits the Host header, so a poisoned entry stays valid until eviction. The fix in 14.2.10 requires explicit opt-out of full-route cache for pages with redirect logic. The broader lesson: every cache key must include any value that flows into the rendered response, especially headers that the server itself uses to construct URLs.
2024-11-15
5 min
#Vulnerability Analysis
Security Research
CVE-2024-9264 is a post-authentication DuckDB SQL injection in Grafana OSS/Enterprise 11.0.0-11.2.1, CVSS 8.8. An authenticated user can inject DuckDB commands to read arbitrary files, and on specific versions (with the duckdb binary installed), execute arbitrary system commands, achieving RCE. The SQL interface forwards raw expressions to the DuckDB engine without allowlist, so attacker-controlled DuckDB functions like read_csv() and load_extension() become the bridge from query box to filesystem. The lesson is that any data source that runs native commands is a privilege boundary, and the SQL editor itself needs the same isolation as a system shell.
2024-10-15
5 min
#Vulnerability Analysis
Security Research
CVE-2024-5420 is an XSS vulnerability in SEH Computertechnik UTNserver Pro/ProMAX/INU-100 prior to 20.1.22, CVSS 8.3. An attacker crafts a malicious URL to inject JavaScript into the UTN Server admin web interface, stealing admin sessions or performing other malicious actions. The management web interface renders user-controlled parameters without escaping, so a single crafted link can pivot the admin session. The interesting twist: this device bridges USB over the network for printers and dongles, so the XSS also yields access to the USB-over-IP control plane, not just the web shell.
2024-08-15
2 min
#Vulnerability Analysis
Security Research
CVE-2024-41992 is a remote code execution vulnerability in the Arcadyan FMIMG51AX000J router firmware (used in WiFi Alliance EasyMesh certified devices), CVSS 9.8. An attacker triggers unauthenticated RCE through the web interface, impacting a large number of ISP-deployed home gateways globally. The firmware ships a hidden diagnostic page that calls system() with attacker-controlled parameters; that diagnostic path is reachable from the LAN management interface without authentication. Because the same firmware is re-branded by many ISPs, the blast radius is the entire supply chain: one firmware bug, hundreds of carriers, millions of household gateways.
2024-08-06
4 min
#Vulnerability Analysis
Security Research
CVE-2024-27956 is a SQL injection in the WordPress valvePress/Automatic plugin, CVSS 9.9. An attacker bypasses authentication with %0a in the auth parameter, then injects SQL through the q parameter to dump the entire database, finally creating an eviladmin account and popping a shell. The auth check splits the input on the newline character but the database connection accepts %0a as a line terminator inside a string literal, so an attacker appends a second query that the database happily executes. The fix is to use parameter binding at the auth check as well. The lesson: any input that crosses a line-ending boundary deserves parameterization, not just text fields.
2024-07-15
5 min
#Vulnerability Analysis
Security Research
CVE-2024-38475 is a mod_rewrite path traversal in Apache HTTPD prior to 2.4.59, CVSS 9.1, disclosed by Orange Tsai at BlackHat 2024. An attacker crafts a special request to bypass mod_rewrite rule mapping, access files outside the web root, and under specific configurations, achieve RCE. The flaw is in the substitution target: a malformed input lets the rule's replacement be re-interpreted, so a path meant to land in the docroot lands in the parent directory. With RewriteRule flags that hand the request off to a CGI handler, that out-of-root file becomes a server-side script and turns into RCE.
2024-07-15
5 min
#Vulnerability Analysis
Security Research
CVE-2024-40725 is an HTTP request smuggling vulnerability in Apache HTTPD prior to 2.4.61, CVSS 5.3. An attacker exploits the inconsistency between how Apache handles Content-Length with special characters and how the proxy/backend interprets the same request, smuggling a second request through. The CL.0 variant: Apache reads the body using chunked transfer and disregards the Content-Length header, while the backend trusts the same Content-Length. The fix is to make Apache normalize or reject the conflicting header pair. Smuggling is a protocol boundary flaw: every hop in the chain has its own parser, and any disagreement becomes a smuggling channel.
2024-07-15
5 min
#Vulnerability Analysis
Security Research
CVE-2024-4956 is a path traversal in Sonatype Nexus Repository OSS prior to 3.68.1, CVSS 7.5. An attacker crafts a special URL to bypass path restrictions and read arbitrary files on the server (such as /etc/passwd, configuration files, keys) without authentication. The vulnerable endpoint is the static-asset handler, which concatenates a base directory with the request path and serves the result. The traversal lands on /etc/passwd first, then escalates to /opt/sonatype/nexus/etc/nexus.properties, which leaks the admin password hash. The lesson is that an artifact server is also a file server, and any file-serving endpoint must normalize and confine the path to a known allowlist.
2024-07-15
4 min
#Vulnerability Analysis
Security Research
CVE-2024-38094 is a remote code execution vulnerability in Microsoft SharePoint Server, CVSS 6.3, affecting many SharePoint Server deployments. An attacker bypasses authentication through a crafted request and executes arbitrary code on the server, gaining access to all SharePoint content. The vulnerable handler trusts the request path before authentication, then evaluates it as a server-side template, so the unauthenticated call ends up compiling user input as .NET code. The fix in the July 2024 patch validates the route through the authentication pipeline. The lesson is that any code-evaluation endpoint needs to live behind the same auth check as the rest of the surface, not in front of it.
2024-07-09
4 min
#Vulnerability Analysis
Security Research
CVE-2023-7137 is a SQL injection in Client Details System 1.0, CVSS 8.8, located in the login endpoint's uemail parameter. An attacker uses classic OR 1=1 payloads to bypass authentication, then hands the request to SQLmap to dump the entire database. The root cause is missing input sanitization in the login path. The boolean-based variant reveals the vulnerability through differential responses: a true condition logs the attacker in, a false condition rejects. Even legacy PHP applications still ship with string-concatenated SQL, and the login endpoint is the worst place for that mistake because it gives the attacker a free boolean oracle on every account.
2024-07-04
4 min
#Vulnerability Analysis
Security Research
CVE-2024-7954 is an RCE in the Prote_plume plugin, CVSS 9.8. An attacker triggers code injection via an unauthenticated request, executing arbitrary commands on the server. The plugin is designed as a security scanning tool but itself contains a critical security flaw. The irony is sharp: a tool meant to defend the codebase ships with a backdoor of its own. The unauthenticated endpoint accepts a remote template parameter and renders it through PHP's eval()-equivalent, so an attacker can hand-craft a request that the server then compiles and runs. The fix removes the eval path entirely and confines the scanner to read-only checks. The lesson generalizes: any tool that calls into user-controllable code is itself an attack surface.
2024-05-20
4 min
#Vulnerability Analysis
Security Research
CVE-2023-50164 is a file upload path manipulation RCE in Apache Struts 2.5.0-2.5.33 and 6.0.0-6.3.0.2, CVSS 9.8. Attackers manipulate file upload parameters to control the upload path and combine it with Struts' OGNL injection to achieve unauthenticated RCE. The Struts file upload handler passes the filename through the OGNL expression engine, so a crafted filename is evaluated as a server-side expression. The attacker chains this with a path-traversal in the upload destination to land a server-side script in the webroot, then triggers the upload handler to evaluate it. The framework is famous for OGNL, and this CVE is the reminder that any expression engine in a request path is a remote shell.
2024-05-15
4 min
#Vulnerability Analysis
Security Research
CVE-2024-24919 is an arbitrary file read flaw in Check Point Security Gateway's SSL Network Extender, CVSS 8.6. An unauthenticated attacker POSTs to /clients/MyCRL to read /etc/passwd; combined with Censys dorks and nuclei templates, the exposure is harvested at internet scale. The endpoint is a CRL fetcher that returns the contents of a path-attacker-controlled file; the path filter trusts everything after the prefix, so the response leaks any file the gateway process can read. The lesson is that an admin-facing endpoint that accepts user input and returns file contents is a file read primitive; the only safe design is a strict allowlist of paths the system itself owns.
2024-05-15
4 min
#Vulnerability Analysis
Security Research
CVE-2024-32002 is a Git RCE, CVSS 9.0, triggered by git clone –recursive. The attacker prepares a malicious repository: the submodule contains a malicious post-checkout hook plus a symlink pointing to the .git directory. When the victim clones it, Git executes the hook and achieves RCE. The attack abuses two cooperating features: submodules run their hooks on the parent repository's behalf, and case-insensitive filesystems on macOS let a symlink named .GIT point into the parent. The hook is then activated during the recursive checkout phase. The fix tightens submodule hook execution rules and the symlink handling. The lesson: a clone is not a passive read; the result it produces is a running system.
2024-05-15
5 min
#Vulnerability Analysis
Security Research
CVE-2023-46943 is a misconfiguration in JWT token verification, CVSS 9.1. It affects applications that use third-party JWT libraries without enforcing signature checks. The attacker changes the alg field in the JWT header to none or substitutes the signing key to bypass verification and impersonate any user. The flaw is a misconfiguration, not a library bug: most JWT libraries accept alg=none when the developer does not explicitly reject it, and the verification middleware in this project allowed the same. The lesson is that JWT verification is a four-step ritual — parse, check alg, verify signature, check claims — and skipping any single step turns the token into a free impersonation ticket.
2024-05-01
5 min
#Vulnerability Analysis
Security Research
CVE-2024-3400 is a command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect, scoring the maximum CVSS 10.0. An attacker triggers command injection via a crafted request and writes a cron job for persistence. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates a chained impact across the entire enterprise. The session-id field flows into a shell command with insufficient escaping, so a single HTTP request can write a cron entry that survives reboots. The vulnerability was weaponized by APT actors within days, and Shadowserver observed mass scanning. The lesson is that an edge device that lets external input land in a shell command is the highest-value target in the perimeter.
2024-04-12
5 min
#Vulnerability Analysis
Security Research
CVE-2024-4439 is an unauthenticated stored XSS in WordPress Core prior to 6.5, CVSS 7.2, located in the Block Editor. An attacker triggers XSS through carefully crafted post content, and when the victim views the post, malicious JavaScript executes, letting the attacker hijack accounts or plant backdoors. The Block Editor parses user-supplied HTML to extract block structures but does not strip event handlers, so a stored post can carry a live script. The combined effect of CVE-2024-4439 and CVE-2024-4440 in the same release forms a full chain: unauthenticated stored XSS plus an account-takeover that bypasses CSRF checks. The fix in 6.5 adds an HTML allowlist and an iframe sandbox to the embed block. The lesson: a CMS render path that takes user HTML is a XSS surface by default, and the only safe design is a strict allowlist.
2024-04-09
4 min
#Vulnerability Analysis
Security Research
CVE-2024-23724 is a stored XSS in Ghost CMS 5.76.0. An attacker uploads an SVG containing JavaScript as a profile avatar, then lures the Ghost Owner to view the profile page, automatically transferring the Owner role to the attacker. The fix uses DOMPurify to sanitize SVG uploads. The chain runs in three steps: the attacker uploads the malicious SVG, the Owner's browser renders the avatar and executes the embedded script, the script then uses the active session to call the role-transfer API. SVG is a fully featured XML grammar; any unfiltered upload is a script-injection channel. The lesson is that an avatar uploader must reject active content, not just file extensions.
2024-03-22
3 min
#Vulnerability Analysis
Security Research
CVE-2024-29291 is a database credential leak in Laravel 8-11, CVSS 4.5. When a PDOException is thrown, Laravel writes the database DSN, username, and password in full to storage/logs/laravel.log (when APP_DEBUG=true), letting an attacker connect directly to the database once they obtain the log. The leak comes from the default exception renderer: the DSN is included in the message string, and that string is then written to the log unredacted. The log file is web-accessible on many default deployments. The fix in Laravel 11.7 redacts the password component. The lesson is that any exception renderer and any logger that prints driver-level strings is also a credential printer, and the right default is to redact everything that looks like a secret.
2024-03-22
6 min
#Vulnerability Analysis
Security Research
CVE-2023-7028 is an account takeover in GitLab CE/EE prior to 16.1.0, CVSS 7.5. The /users/password endpoint accepts an array for user[email], causing GitLab to send the same password-reset link to both the victim and the attacker's address. The attacker uses the leaked token to reset the password. The Rails parameter parser interprets user[email][] as an array by default, so the attacker submits the victim's email first and the attacker's email second; the password-reset mailer iterates and sends to both. The fix rejects non-scalar email values at the controller boundary. The lesson: any controller that maps a single-valued field into a typed parameter parser must enforce the type at the boundary, not at the model.
2024-03-14
5 min
#Vulnerability Analysis
Security Research
CVE-2023-6553 is an unauthenticated RCE in WordPress Backup Migration < 1.3.8, CVSS 9.8. The /includes/backup-heart.php endpoint mishandles user input, and an attacker can use a PHP filter chain to write a PHP shell to disk and execute arbitrary commands without authentication. The endpoint accepts a file-content parameter that passes through PHP's file_put_contents without checking the extension; the filter chain technique then rewrites the bytes into valid PHP one character at a time using base64 and rot13. The technique turns any write primitive into a code-execution primitive, even when the destination filename is fixed. The lesson: a write-to-server endpoint must constrain the path and the file type, not just the input string.
2024-02-29
6 min
#Vulnerability Analysis
Security Research
CVE-2023-51766 is an SMTP smuggling flaw in Exim before 4.97.1, CVSS 5.3. This piece walks through the protocol-level end-of-data ambiguity, the path that lets outbound servers pass . while inbound Exim treats it as DATA termination, and the boundary conditions against GMX/Ionos/Exchange Online. The end-of-data sequence is a single byte: the line containing only a period (.). RFC 5321 calls it the data terminator, but the surrounding CR/LF rules differ across implementations; Exim historically accepted any of LF.LF, CR.LF, or LF. as a valid terminator, while many outbound senders emit a stricter one. An attacker who can choose the outbound terminator can hide a second envelope inside the same message. The lesson is that SMTP is line-oriented and tolerant, and tolerance at the protocol layer is a smuggling channel.
2024-02-15
6 min
#Vulnerability Analysis
Security Research
CVE-2023-31893 is a DNS recursion DoS in Telefônica Brasil's Vivo Play IPTV device (firmware 2023.04.04.01.06.15), CVSS 7.5. The device exposes DNS recursion to the public internet, letting an attacker spoof source IPs in DNS queries to trigger amplification responses that overwhelm the device. The fix is to disable recursion and restrict recursive clients to trusted networks. Open DNS recursion has been a known DoS primitive for two decades, yet carrier-grade CPE still ships with recursion enabled for the LAN. A single open resolver on the network becomes an amplification target: the attacker sends small DNS queries with the victim's IP as the source, and the resolver dutifully returns much larger responses. The lesson: any network device that listens on UDP/53 should default to no recursion, and recursion should be a deliberate per-VLAN config, not a build default.
2024-02-08
6 min
#Vulnerability Analysis
Security Research
CVE-2023-4357 is an XEE (XML External Entity) vulnerability in Google Chrome, CVSS 8.8. An attacker crafts a malicious XML document that uses the browser's XML parser to read local files, requiring user interaction but with significant impact. The browser XML parser is shared by every component that handles SVG or SOAP, so the XXE primitive reaches into any feature that accepts user-supplied XML. A crafted SVG that references an external entity leaks the contents of files like /etc/passwd when the user merely views the page. The fix disables external entity loading in the parser. The lesson is that any XML parser exposed to user content must run with the XXE-safe configuration; allowing the default is always a file-read primitive.
2024-01-15
4 min
#Vulnerability Analysis
Security Research
CVE-2024-22144 is a code injection in the WordPress GOTMLS plugin prior to 4.21.96, CVSS 9.0, affecting more than 200,000 active installations. The plugin concatenates user input without sanitization, letting an attacker execute arbitrary PHP and write a webshell without authentication. The vulnerable function reads a user-supplied setting name, concatenates it into a call_user_func-style expression, and passes the result through eval(). A crafted setting name becomes a PHP statement. With 200,000 active installs the blast radius is significant: one unauthenticated POST and the server is owned. The fix in 4.21.96 removes the eval call and switches to a function-name allowlist. The lesson: any code path that calls eval() on user input is by definition a remote shell, no matter what the wrapper function looks like.
2024-01-15
4 min
#Vulnerability Analysis
Security Research
CVE-2024-34351 is an SSRF flaw in Next.js 14.1.1 and below, CVSS 7.5. When Server Actions handle a redirect starting with /, they build the fetch URL from the request Host header — so an attacker can point Next.js at any internal address. A Flask pivot turns it into a full-read SSRF. The fetch URL is constructed by combining the host header with a relative path; an attacker who controls the host header can redirect the fetch to an arbitrary internal service. A Flask receiver then serves internal-only responses back through the same channel. The fix in 14.1.2 hardens Server Actions against user-controlled hosts. The lesson: any internal fetch that uses request-time data to construct the URL is a SSRF, even when the path looks relative.
2024-01-15
6 min
#Vulnerability Analysis
Security Research
node-serialize 0.0.4's unserialize() does no filtering on fields prefixed with _$$ND_FUNC$$_. Combined with an IIFE, this lets an attacker execute arbitrary Node.js code at the moment of deserialization. This post breaks down the mechanism, payload construction, reproduction path, and remediation guidance.
2024-01-15
5 min
#Vulnerability Analysis
