Research Archive
Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.
CVE-2025-32433 is a pre-authentication RCE in the Erlang/OTP SSH server, CVSS 10.0. After a standard SSH handshake, attackers send Erlang expressions (not normal shell commands) on the session channel — OTP SSH hands the string to the Erlang VM to evaluate before authentication, achieving unauthenticated RCE.
CVE-2025-52287 is a Windows Server Update Services deserialization RCE, CVSS 9.8. Attackers use a 4-stage chain (obtain ID → grab cookie → use cookie to trigger SimpleAuth → inject deserialization payload) to gain RCE on the WSUS server, controlling the enterprise patch distribution center.
CVE-2025-5777 is a memory overread vulnerability in Citrix NetScaler, CVSS 7.5. NetScaler accepts unauthenticated requests in VPN / ICA Proxy / CVPN / RDP Proxy / AAA modes, and the field in the login response XML reflects user input. An attacker can craft a payload that triggers memory overread, leaking NetScaler process memory contents including session tokens, configuration, and credentials.
CVE-2025-0133 is a reflected XSS in Palo Alto Networks PAN-OS GlobalProtect Gateway and Portal, CVSS 6.9 (CVSS v4.0). An attacker crafts a malicious URL to inject JavaScript into the VPN login page, stealing user credentials or hijacking sessions.
CVE-2025-0108 is an authentication bypass in Palo Alto Networks PAN-OS, CVSS 9.8. An attacker bypasses the management interface authentication via a specific path and accesses management functions directly. Combined with CVE-2024-3400 or similar command injection, it enables unauthenticated RCE.
CVE-2025-0282 is a pre-authentication stack-buffer-overflow RCE disclosed in Ivanti Connect Secure in January 2025, CVSS 9.0. Attackers send overlong strings to the /dana-na/auth/url_default/welcome.cgi endpoint, trigger a stack overflow, overwrite the return address with system(), and execute arbitrary commands on the VPN gateway without credentials.