0day Hunting the Day After xAI Open-Sourced grok-build (Part 4): ptyctl Test Server's Zero-Auth CORS and Cross-Origin RCE
0day (4) I found the day after xAI open-sourced grok-build.
Research Archive
Web Security
Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.
2026
2025
CVE-2025-53770 SharePoint WebPart Injection Deserialization RCE: Active Exploitation Before Patch Day
CVE-2025-53770 is a Microsoft SharePoint Server (on-prem) WebPart injection + .NET deserialization RCE. Microsoft has confirmed in-the-wild exploitation; attackers inject malicious WebPart payload via unauthenticated POST /_layouts/15/ToolPane.aspx, triggering .NET deserialization gadget chain to take down the SharePoint server.
CVE-2025-44148 MailEnable Webmail Reflected XSS: Unsanitized state Parameter in failure.aspx
CVE-2025-44148 is a reflected XSS in MailEnable Webmail before version 10, CVSS 6.1. Attackers craft a state parameter containing malicious JavaScript and visit /Mondo/lang/sys/Failure.aspx; MailEnable writes it directly into HTML without sanitization, triggering the browser to execute arbitrary JS — stealing sessions and launching phishing.
CVE-2025-55184 React Server Components Infinite Loop DoS: A Single Payload Locks CPU
CVE-2025-55184 is a denial-of-service in React Server Components (RSC), CVSS 7.5. Attackers send a carefully crafted HTTP request to the Server Function endpoint, triggering the RSC deserialization flow into an infinite loop, consuming 100% CPU for DoS, affecting React 19.0.0 to 19.2.1.
Explore CMS v1.1 Reflected XSS: How a Community CMS's UserID Field Became the Attack Entry Point
The user/login.php and admin/login.php endpoints in Explore CMS v1.1 perform zero sanitization or validation on the UserID field. An attacker can trigger reflected XSS with a simple
CVE-2025-32395 Vite Dev Server Path Traversal: # Character Bypass of server.fs.deny
CVE-2025-32395 is a path traversal in Vite Dev Server, CVSS 5.9. Attackers use the # character in URLs to bypass the server.fs.deny middleware; combined with /../, the path escapes the project directory to read arbitrary files.
CVE-2025-4123 Grafana Full-Read SSRF + Account Takeover: Open Redirect + CSPT + Client-Side Traversal Chain
CVE-2025-4123 is a Grafana full-read SSRF + account takeover chain, CVSS 7.6. Attackers use staticHandler's Open Redirect + render endpoint's SSRF + plugin-app explore's CSPT to poison attacker-controlled JSON into the client, hijack module loading, and achieve Account Takeover.
CVE-2025-30406 CentreStack Deserialization to RCE: Hard-coded Machine Key + ASP.NET ViewState Exploitation
CVE-2025-30406 is a hard-coded Machine Key vulnerability in CentreStack / Triofox before 16.1.10296.56315, CVSS 9.8. Attackers use ysoserial to generate a malicious ViewState payload, sign it with the hard-coded validation key, and send it to an ASP.NET endpoint to trigger deserialization and execute arbitrary commands.
CVE-2025-29927 Next.js Authentication Bypass: x-middleware-subrequest Recursion Depth Evasion
CVE-2025-29927 is a Next.js middleware authorization bypass, CVSS 9.1. Attackers craft an x-middleware-subrequest header with recursion depth ≥ MAX_RECURSION_DEPTH (5) so Next.js treats the request as an internal subrequest and skips the entire middleware chain — unauthenticated access to protected pages.
CVE-2025-24813 Apache Tomcat Path Equivalence + Persistent Session RCE: Partial PUT and Default Servlet Converging
CVE-2025-24813 is a path-equivalence plus persistent-session RCE in Apache Tomcat, CVSS 9.8. The attacker uses the Content-Range partial PUT to write to .internal in Tomcat's work directory, then triggers default servlet to read the file as JSP for compilation and execution, achieving remote RCE.
CVE-2025-27415 Nuxt.js Cache Poisoning DoS: Newline Bypass on Route Regex
CVE-2025-27415 is a Cache Poisoning denial-of-service in Nuxt.js, CVSS 7.5. The attacker uses newline plus space combinations in URLs to bypass the route regex, triggering Nitro route matching with an empty cache key, causing the cache to grow without bound and exhausting memory for DoS.
CVE-2024-12877 GiveWP PHP Object Injection: When unserialize Meets Magic Methods
CVE-2024-12877 is a PHP Object Injection in GiveWP before 3.19.3, CVSS 7.5. Attackers craft a malicious serialized object that triggers __wakeup / __destruct to execute arbitrary code; even the improved is_serialized regex cannot save an application that still calls unserialize on user input.
CVE-2024-12877 GiveWP PHP Object Injection: unserialize vs. Regex, a Futile Fight
CVE-2024-12877 is a PHP object injection flaw in GiveWP 3.19.2 and below, CVSS 7.5. The plugin validates serialized input with regex, but as long as unserialize() runs on user input, regex is decoration — attackers bypass it and trigger __wakeup() magic methods to reach RCE.
2024
CVE-2024-10793 WP Activity Log: Stored XSS to RCE in the Audit Page
CVE-2024-10793 is a stored XSS flaw in WP Activity Log 5.2.1 and below, CVSS 7.2. Attackers POST unfiltered log entries via admin-ajax.php; when an admin views the log page the XSS fires, steals a nonce, and uploads a PHP webshell to reach RCE. The audit page treats the log database as a trusted render plane, and the write path accepts HTML fragments from any authenticated subscriber. The exploit follows a simple chain: insert payload, wait for admin to view log, run injected script under the admin origin, abuse WordPress nonce to authorize a plugin upload, drop a PHP shell. The audit trail is exactly where least-privilege XSS is most expensive.
CVE-2024-10793 WP Activity Log Stored XSS to RCE: Unsanitized Writes to the Admin Render Plane
CVE-2024-10793 is a stored XSS flaw in WP Activity Log before 5.2.1, CVSS 7.2. An attacker injects unsanitized log entries via admin-ajax.php; when an admin opens the activity log panel, the XSS fires and chains nonce theft with plugin upload to drop a PHP Webshell, escalating anonymous XSS to RCE. The render plane for the activity log trusts whatever the write path hands over, and the write path accepts HTML fragments from any subscriber-level user. The fix mirrors the same pattern: sanitize at the write path, escape at the render path, and never mix user-supplied data with the trusted admin context. The chain also reveals why low-privilege XSS still matters: the admin browser is the most privileged context on the site.
Three npm Vulnerabilities in lunary-ai: SAML XSS, IDOR, and Privilege Escalation on the Same Trust Chain
lunary-ai/lunary versions before 1.6.7 carry three CVEs in one release line: CVE-2024-10273 Stored XSS in SAML metadata, CVE-2024-11137 IDOR in the PATCH /v1/runs/:id/score endpoint, and CVE-2025-0281 privilege escalation in PATCH /v1/models/:id. Each one lives in a different surface area, yet every root cause points to the same consistency gap: the platform treats authentication as equivalent to authorization. The SAML parser keeps attacker-controlled script nodes; the score endpoint only checks the project's owner, ignoring whether the requester is the project itself; the model endpoint omits a project-id check. The fix is twofold: sanitize the SAML metadata through an allowlist parser, and centralize the project membership check. The lesson generalizes: every authenticated route must answer both 'who are you' and 'what can you touch'.
CVE-2024-52875 Kerio Control CRLF Injection to 1-click RCE: silent firewall takeover
CVE-2024-52875 is a CRLF injection in Kerio Control 9.2.5 to 9.4.5, CVSS 8.8. An attacker crafts a request with CRLF characters to inject HTTP headers, and with social engineering to make an admin click the link, achieves 1-click RCE and full firewall control. CRLF characters in user input should never survive into a header line; the firewall's admin web interface forgets that rule, and a redirect parameter becomes the entry point. The exploit chain runs response splitting, cookie injection, then a script body that calls the firewall's own API. The lesson is that 1-click does not mean low impact: a single admin click on a phishing message compromises the entire gateway.
CVE-2024-46982 Next.js Cache Poisoning: silent hijacking of non-dynamic SSR pages
CVE-2024-46982 is a cache poisoning vulnerability in Next.js 13.5.1 to 14.2.9.2, CVSS 7.5. Non-dynamic SSR pages do not isolate user-specific data at the cache layer. An attacker poisons the cache by injecting a malicious Host header, and subsequent users receive the poisoned response, leading to XSS or credential theft. The cache key omits the Host header, so a poisoned entry stays valid until eviction. The fix in 14.2.10 requires explicit opt-out of full-route cache for pages with redirect logic. The broader lesson: every cache key must include any value that flows into the rendered response, especially headers that the server itself uses to construct URLs.
CVE-2024-9264 Grafana DuckDB SQLi to RCE: authenticated database piercing
CVE-2024-9264 is a post-authentication DuckDB SQL injection in Grafana OSS/Enterprise 11.0.0-11.2.1, CVSS 8.8. An authenticated user can inject DuckDB commands to read arbitrary files, and on specific versions (with the duckdb binary installed), execute arbitrary system commands, achieving RCE. The SQL interface forwards raw expressions to the DuckDB engine without allowlist, so attacker-controlled DuckDB functions like read_csv() and load_extension() become the bridge from query box to filesystem. The lesson is that any data source that runs native commands is a privilege boundary, and the SQL editor itself needs the same isolation as a system shell.
CVE-2024-5420 SEH UTN Server XSS: cross-site scripting in USB device management interface
CVE-2024-5420 is an XSS vulnerability in SEH Computertechnik UTNserver Pro/ProMAX/INU-100 prior to 20.1.22, CVSS 8.3. An attacker crafts a malicious URL to inject JavaScript into the UTN Server admin web interface, stealing admin sessions or performing other malicious actions. The management web interface renders user-controlled parameters without escaping, so a single crafted link can pivot the admin session. The interesting twist: this device bridges USB over the network for printers and dongles, so the XSS also yields access to the USB-over-IP control plane, not just the web shell.
CVE-2024-27956 WP Automatic SQL Injection: from 9.9 plugin bug to admin account takeover
CVE-2024-27956 is a SQL injection in the WordPress valvePress/Automatic plugin, CVSS 9.9. An attacker bypasses authentication with %0a in the auth parameter, then injects SQL through the q parameter to dump the entire database, finally creating an eviladmin account and popping a shell. The auth check splits the input on the newline character but the database connection accepts %0a as a line terminator inside a string literal, so an attacker appends a second query that the database happily executes. The fix is to use parameter binding at the auth check as well. The lesson: any input that crosses a line-ending boundary deserves parameterization, not just text fields.
CVE-2024-38475 Apache HTTPD mod_rewrite path traversal: from BlackHat 2024 to RCE
CVE-2024-38475 is a mod_rewrite path traversal in Apache HTTPD prior to 2.4.59, CVSS 9.1, disclosed by Orange Tsai at BlackHat 2024. An attacker crafts a special request to bypass mod_rewrite rule mapping, access files outside the web root, and under specific configurations, achieve RCE. The flaw is in the substitution target: a malformed input lets the rule's replacement be re-interpreted, so a path meant to land in the docroot lands in the parent directory. With RewriteRule flags that hand the request off to a CGI handler, that out-of-root file becomes a server-side script and turns into RCE.
CVE-2024-40725 Apache HTTPD HTTP request smuggling: Content-Length parsing inconsistency
CVE-2024-40725 is an HTTP request smuggling vulnerability in Apache HTTPD prior to 2.4.61, CVSS 5.3. An attacker exploits the inconsistency between how Apache handles Content-Length with special characters and how the proxy/backend interprets the same request, smuggling a second request through. The CL.0 variant: Apache reads the body using chunked transfer and disregards the Content-Length header, while the backend trusts the same Content-Length. The fix is to make Apache normalize or reject the conflicting header pair. Smuggling is a protocol boundary flaw: every hop in the chain has its own parser, and any disagreement becomes a smuggling channel.
CVE-2024-4956 Sonatype Nexus OSS Path Traversal: from artifact repository to arbitrary file read
CVE-2024-4956 is a path traversal in Sonatype Nexus Repository OSS prior to 3.68.1, CVSS 7.5. An attacker crafts a special URL to bypass path restrictions and read arbitrary files on the server (such as /etc/passwd, configuration files, keys) without authentication. The vulnerable endpoint is the static-asset handler, which concatenates a base directory with the request path and serves the result. The traversal lands on /etc/passwd first, then escalates to /opt/sonatype/nexus/etc/nexus.properties, which leaks the admin password hash. The lesson is that an artifact server is also a file server, and any file-serving endpoint must normalize and confine the path to a known allowlist.
CVE-2024-38094 Microsoft SharePoint RCE: unauthenticated remote code execution
CVE-2024-38094 is a remote code execution vulnerability in Microsoft SharePoint Server, CVSS 6.3, affecting many SharePoint Server deployments. An attacker bypasses authentication through a crafted request and executes arbitrary code on the server, gaining access to all SharePoint content. The vulnerable handler trusts the request path before authentication, then evaluates it as a server-side template, so the unauthenticated call ends up compiling user input as .NET code. The fix in the July 2024 patch validates the route through the authentication pipeline. The lesson is that any code-evaluation endpoint needs to live behind the same auth check as the rest of the surface, not in front of it.
CVE-2023-7137 Client Details System 1.0 SQL Injection: classic boolean-based bug in uemail
CVE-2023-7137 is a SQL injection in Client Details System 1.0, CVSS 8.8, located in the login endpoint's uemail parameter. An attacker uses classic OR 1=1 payloads to bypass authentication, then hands the request to SQLmap to dump the entire database. The root cause is missing input sanitization in the login path. The boolean-based variant reveals the vulnerability through differential responses: a true condition logs the attacker in, a false condition rejects. Even legacy PHP applications still ship with string-concatenated SQL, and the login endpoint is the worst place for that mistake because it gives the attacker a free boolean oracle on every account.
CVE-2024-7954 Prote_plume Plugin RCE: from open-source security tool to unauthenticated RCE
CVE-2024-7954 is an RCE in the Prote_plume plugin, CVSS 9.8. An attacker triggers code injection via an unauthenticated request, executing arbitrary commands on the server. The plugin is designed as a security scanning tool but itself contains a critical security flaw. The irony is sharp: a tool meant to defend the codebase ships with a backdoor of its own. The unauthenticated endpoint accepts a remote template parameter and renders it through PHP's eval()-equivalent, so an attacker can hand-craft a request that the server then compiles and runs. The fix removes the eval path entirely and confines the scanner to read-only checks. The lesson generalizes: any tool that calls into user-controllable code is itself an attack surface.
CVE-2023-50164 Apache Struts File Upload Path RCE: A Classic Bug in a Classic Framework
CVE-2023-50164 is a file upload path manipulation RCE in Apache Struts 2.5.0-2.5.33 and 6.0.0-6.3.0.2, CVSS 9.8. Attackers manipulate file upload parameters to control the upload path and combine it with Struts' OGNL injection to achieve unauthenticated RCE. The Struts file upload handler passes the filename through the OGNL expression engine, so a crafted filename is evaluated as a server-side expression. The attacker chains this with a path-traversal in the upload destination to land a server-side script in the webroot, then triggers the upload handler to evaluate it. The framework is famous for OGNL, and this CVE is the reminder that any expression engine in a request path is a remote shell.
CVE-2023-46943 JWT Token Verification Bypass: from missing signature checks to identity spoofing
CVE-2023-46943 is a misconfiguration in JWT token verification, CVSS 9.1. It affects applications that use third-party JWT libraries without enforcing signature checks. The attacker changes the alg field in the JWT header to none or substitutes the signing key to bypass verification and impersonate any user. The flaw is a misconfiguration, not a library bug: most JWT libraries accept alg=none when the developer does not explicitly reject it, and the verification middleware in this project allowed the same. The lesson is that JWT verification is a four-step ritual — parse, check alg, verify signature, check claims — and skipping any single step turns the token into a free impersonation ticket.
CVE-2024-4439 WordPress Core Unauthenticated Stored XSS: Block Editor rendering chain
CVE-2024-4439 is an unauthenticated stored XSS in WordPress Core prior to 6.5, CVSS 7.2, located in the Block Editor. An attacker triggers XSS through carefully crafted post content, and when the victim views the post, malicious JavaScript executes, letting the attacker hijack accounts or plant backdoors. The Block Editor parses user-supplied HTML to extract block structures but does not strip event handlers, so a stored post can carry a live script. The combined effect of CVE-2024-4439 and CVE-2024-4440 in the same release forms a full chain: unauthenticated stored XSS plus an account-takeover that bypasses CSRF checks. The fix in 6.5 adds an HTML allowlist and an iframe sandbox to the embed block. The lesson: a CMS render path that takes user HTML is a XSS surface by default, and the only safe design is a strict allowlist.
CVE-2024-23724 Ghost CMS SVG Stored XSS: from avatar upload to Owner takeover
CVE-2024-23724 is a stored XSS in Ghost CMS 5.76.0. An attacker uploads an SVG containing JavaScript as a profile avatar, then lures the Ghost Owner to view the profile page, automatically transferring the Owner role to the attacker. The fix uses DOMPurify to sanitize SVG uploads. The chain runs in three steps: the attacker uploads the malicious SVG, the Owner's browser renders the avatar and executes the embedded script, the script then uses the active session to call the role-transfer API. SVG is a fully featured XML grammar; any unfiltered upload is a script-injection channel. The lesson is that an avatar uploader must reject active content, not just file extensions.
CVE-2024-29291 Laravel database credential leakage: the PDOException logging mistake
CVE-2024-29291 is a database credential leak in Laravel 8-11, CVSS 4.5. When a PDOException is thrown, Laravel writes the database DSN, username, and password in full to storage/logs/laravel.log (when APP_DEBUG=true), letting an attacker connect directly to the database once they obtain the log. The leak comes from the default exception renderer: the DSN is included in the message string, and that string is then written to the log unredacted. The log file is web-accessible on many default deployments. The fix in Laravel 11.7 redacts the password component. The lesson is that any exception renderer and any logger that prints driver-level strings is also a credential printer, and the right default is to redact everything that looks like a secret.
CVE-2023-7028 GitLab Account Takeover: dual-recipient password reset
CVE-2023-7028 is an account takeover in GitLab CE/EE prior to 16.1.0, CVSS 7.5. The /users/password endpoint accepts an array for user[email], causing GitLab to send the same password-reset link to both the victim and the attacker's address. The attacker uses the leaked token to reset the password. The Rails parameter parser interprets user[email][] as an array by default, so the attacker submits the victim's email first and the attacker's email second; the password-reset mailer iterates and sends to both. The fix rejects non-scalar email values at the controller boundary. The lesson: any controller that maps a single-valued field into a typed parameter parser must enforce the type at the boundary, not at the model.
CVE-2023-6553 WordPress Backup Migration Unauthenticated RCE: PHP filter chain weaponized
CVE-2023-6553 is an unauthenticated RCE in WordPress Backup Migration < 1.3.8, CVSS 9.8. The /includes/backup-heart.php endpoint mishandles user input, and an attacker can use a PHP filter chain to write a PHP shell to disk and execute arbitrary commands without authentication. The endpoint accepts a file-content parameter that passes through PHP's file_put_contents without checking the extension; the filter chain technique then rewrites the bytes into valid PHP one character at a time using base64 and rot13. The technique turns any write primitive into a code-execution primitive, even when the destination filename is fixed. The lesson: a write-to-server endpoint must constrain the path and the file type, not just the input string.
CVE-2023-4357 Chrome XEE on WebBrowsers: from XML external entity to arbitrary file read
CVE-2023-4357 is an XEE (XML External Entity) vulnerability in Google Chrome, CVSS 8.8. An attacker crafts a malicious XML document that uses the browser's XML parser to read local files, requiring user interaction but with significant impact. The browser XML parser is shared by every component that handles SVG or SOAP, so the XXE primitive reaches into any feature that accepts user-supplied XML. A crafted SVG that references an external entity leaks the contents of files like /etc/passwd when the user merely views the page. The fix disables external entity loading in the parser. The lesson is that any XML parser exposed to user content must run with the XXE-safe configuration; allowing the default is always a file-read primitive.
CVE-2024-22144 WordPress GOTMLS Plugin Code Injection: a 200k-install string concatenation bug
CVE-2024-22144 is a code injection in the WordPress GOTMLS plugin prior to 4.21.96, CVSS 9.0, affecting more than 200,000 active installations. The plugin concatenates user input without sanitization, letting an attacker execute arbitrary PHP and write a webshell without authentication. The vulnerable function reads a user-supplied setting name, concatenates it into a call_user_func-style expression, and passes the result through eval(). A crafted setting name becomes a PHP statement. With 200,000 active installs the blast radius is significant: one unauthenticated POST and the server is owned. The fix in 4.21.96 removes the eval call and switches to a function-name allowlist. The lesson: any code path that calls eval() on user input is by definition a remote shell, no matter what the wrapper function looks like.
CVE-2024-34351 Next.js SSRF: Server Actions and the Host Header's Quiet Collusion
CVE-2024-34351 is an SSRF flaw in Next.js 14.1.1 and below, CVSS 7.5. When Server Actions handle a redirect starting with /, they build the fetch URL from the request Host header — so an attacker can point Next.js at any internal address. A Flask pivot turns it into a full-read SSRF. The fetch URL is constructed by combining the host header with a relative path; an attacker who controls the host header can redirect the fetch to an arbitrary internal service. A Flask receiver then serves internal-only responses back through the same channel. The fix in 14.1.2 hardens Server Actions against user-controlled hosts. The lesson: any internal fetch that uses request-time data to construct the URL is a SSRF, even when the path looks relative.
2023
CVE-2023-50164 Apache Struts: Path Traversal in File Upload to RCE
CVE-2023-50164 is a file upload path traversal flaw in Apache Struts 2.5.33 and 6.3.0.2 (and below), scored CVSS 9.8. Struts' ActionSupport treats the multipart field name as a property name for setter matching, with no validation of the resolved path; by renaming `upload` to `Upload` and appending an extra form parameter, an attacker can place a webshell outside the intended upload directory — typically straight into Tomcat's `webapps` folder, from where a one-line JSP stager turns into full RCE. The chain is unauthenticated, cross-component, and ends with the attacker holding a Tomcat process shell, able to pivot laterally across the host. The fix is server-side filename rewriting, physical isolation of the upload directory from `webapps`, and minimized Tomcat manager roles, layered on top of a mandatory Struts upgrade.
CVE-2023-49103 + CVE-2023-49105 ownCloud Info Leak + Privilege Escalation to RCE Chain: How PHPinfo Exposure Became the Attacker's Key
CVE-2023-49103 (CVSS 10) is an unauthenticated PHPinfo exposure in ownCloud <= 10.13.1 that lets anyone reach /settings/phpinfo and harvest the full PHP configuration, including the bundled ImageMagick version, the GraphQL endpoint, and writable temp directories. CVE-2023-49105 (CVSS 9.8) is a WebDAV URL signature forgery triggered by the default empty signing key: an attacker who knows a username can sign requests with the empty HMAC and impersonate that user against /remote.php/dav. Chained together, the two issues form a complete RCE path: PHPinfo gives reconnaissance, WebDAV forgery gives arbitrary-user file access, and an older ImageMagick issue (such as ImageTragick) turns a crafted upload into shell. The remediation is not just upgrading ownCloud; it is the eight-piece baseline of upgrade + WAF blocking phpinfo + private-only DAV + per-user signing keys + ImageMagick upgrade + audit logs + 2FA + config monitoring, applied simultaneously.
CVE-2023-43341 Evolution CMS Reflected XSS: Reflected Attack Surface in the Admin Panel
CVE-2023-43341 is a Reflected XSS in Evolution CMS prior to v3.2.3, CVSS 6.1. Attackers craft URLs with specific parameters (such as search and page) that reflect javascript: protocol in the Evolution admin panel, triggering XSS.
CVE-2023-38286 Spring Boot Admin SSTI: Thymeleaf Expression Injection to RCE
CVE-2023-38286 is a server-side template injection (SSTI) in spring-boot-admin < 3.1.0 + thymeleaf < 3.1.1, CVSS 9.8. Attackers craft specific request headers so that the Thymeleaf view layer parses malicious SpEL expressions, ultimately achieving RCE.
CVE-2023-4357 Chrome LibXSLT XEE: The XML External Entity Surface Browsers Forgot
CVE-2023-4357 is an XEE flaw in LibXSLT as used by WebKit-based browsers (Chrome, Safari, Samsung TV browser, plus any Electron/PhantomJS app that runs without --no-sandbox), scored CVSS 8.8. The library still allows external entities in XSL `document()` calls, so a crafted XSL/XML pair makes the browser read `file://` resources outside the sandbox — `/etc/hosts`, `/etc/shadow`, Windows system32 configs, even the macOS Keychain DB on Electron builds running un-sandboxed. The attack requires the victim to visit a hostile URL, which is what the UI:R segment of the vector represents. The fix is three things at once: disable external entities by default, enforce an explicit whitelist, and tighten the sandbox; layering those closes the 1999-era tunnel that was still wide open in 2023 browsers.
CVE-2023-25157 GeoServer SQLi: Property Injection in OGC API Filters
CVE-2023-25157 is a SQL injection in GeoServer prior to 2.22.1 / 2.21.4 (and several earlier branches), scored CVSS 9.8. The OGC Filter functions exposed via WFS GetFeature concatenate the `property name` parameter straight into the SQL subquery with no sanitization, so an attacker who controls the CQL_FILTER can splice arbitrary SQL clauses through functions like `strStartsWith` and `strEndsWith`. The injection is unauthenticated and reaches the underlying PostgreSQL/PostGIS backend, allowing full read of GIS data plus lateral movement to other databases via `dblink` or `COPY PROGRAM`. The fix is the OGC-correct approach: a strict whitelist in the property name parser, paired with database prepared statements, so the protocol's legitimate characters (`/`, `:`, numeric subscripts) can no longer be misused as SQL.
CVE-2023-24488 QR Code Generator XSS: A Stored XSS on code-projects.org
CVE-2023-24488 is a Stored XSS in the QR Code Generator Web application published on code-projects.org, CVSS 6.1. Attackers inject a javascript: protocol URL into the QR Code text field, and the generated QR Code triggers XSS when scanned or previewed.
2022
CVE-2022-48110 CKEditor 5 XSS: Sanitizer Gaps in data: URL Schemes
CVE-2022-48110 is a Stored XSS in CKEditor 5 prior to v35.4.0, CVSS 6.1. The model-view architecture that the editor adopted to eliminate XSS still hits a corner case during model-to-view deserialization: the HTML data processor allows a `data:` URL through in an `` tag, and the browser happily executes the base64-decoded payload when the victim clicks the link. The crafted payload wraps a full HTML document (with a `
2021
CVE-2021-39316 DZS Zoomsounds: Unauthenticated Arbitrary File Read
CVE-2021-39316 is an unauthenticated arbitrary file read in the DZS Zoomsounds WordPress plugin prior to version 6.45, CVSS 7.5. The plugin exposes a `download` endpoint via the `wp_ajax_nopriv_dzsapplies_readfile` action — a hook that any unauthenticated visitor can fire — and the handler reads whatever path the client passes in the `path` parameter with no allowlist and no traversal check. In practice the attacker passes `../../../wp-config.php` and gets back the database credentials, secret keys, and auth salts; a quick hop to `/etc/passwd` confirms the wider exposure. With the database password, the attacker can log straight into MySQL, modify the admin account, drop a malicious plugin, or write a PHP shell — the full ladder from a single unauthenticated GET to a server takeover. The interesting detail is that the hook itself isn't the bug; it's the combination of an unauthenticated AJAX entry point plus a file-read call that trusts the client. The fix in 6.46 is a path allowlist, but the broader lesson is that WordPress's `wp_ajax_nopriv_*` family is a permanent place to look for forgotten permission checks.
CVE-2021-3129 Laravel Ignition RCE: Phar Deserialization Path in Debug Mode
CVE-2021-3129 is a phar deserialization RCE in Laravel 8.4.2 and below when Debug mode is enabled, exploiting the `_ignition/execute-solution` endpoint in Ignition 2.5.1 and below, scored CVSS 9.8. The root cause is a chain of three individual non-fatal choices that combine into a critical RCE: the convenience 'click to fix' endpoint accepts a class name and calls its `run()` method without authentication, the `phar://` stream wrapper remains enabled and silently deserializes the metadata field of any phar it touches, and Laravel's Monolog log file can be coerced into containing a payload that looks like a valid phar. The exploitation chain is a three-call sequence: clear the log, write a payload-bearing log entry, then trigger `phar://` parsing via the Ignition endpoint. The result is arbitrary PHP object instantiation in the web process context (typically www-data) — full RCE on the Laravel host. Patching is simple: upgrade to Laravel 8.4.3 or Ignition 2.5.2, and in production set `APP_DEBUG=false`. The broader lesson is that 'developer convenience' features are exposed as unauthenticated HTTP endpoints, and any active deserialization path in the runtime is a permanent invitation to attackers.
2020
CVE-2020-981 CKEditor 4 XSS: Sanitizer Boundaries in Rich Text Editors
CVE-2020-981 is a sanitizer bypass in CKEditor 4 prior to v4.13, scored CVSS 6.1. The built-in HTML filter accepts combinations of `` plus a CSS-positioned overlay form, letting an attacker plant a Stored XSS that triggers on the victim's first click. The flaw shows up in any web application that embeds CKEditor 4 — forums, CMS, mail clients — and is routinely chained into a foothold step for cookie theft, CSRF, and ultimately RCE. The fix in v4.13 moved to a strict whitelist combined with context-sensitive attribute validation, which is the more modern industry direction.
2019
CVE-2019-15107 Webmin Unauthenticated RCE: command injection in password_change.cgi
CVE-2019-15107 is a pre-authentication command injection in Webmin <= 1.920, scored CVSS 9.8 Critical. The vulnerability lives in `password_change.cgi` when the user-password-change feature is enabled (`passwd_mode=2`, on by default in Webmin < 1.890). An unauthenticated attacker injects a pipe character into the `old` parameter, which is interpolated into a Perl `qx{}` shell context used by `unix_crypt` to read `/etc/shadow` for old-password validation — turning a password primitive into an RCE primitive. The fix in Webmin 1.930 replaces `qx{}` with `system(list)` and a parameter whitelist, structurally breaking the input-string-equals-executable-command equivalence.
2018
Code Audit: Z-BlogPHP 1.5.1 Zero GetShell Vulnerability Analysis
Reproducing an arbitrary file-write vulnerability in Z-BlogPHP 1.5.1 Zero's AppCentre plugin editor. plugin_edit.php exposes two file_put_contents calls where both path and content are user-controlled; combined with a regex that only constrains the leading characters of app_id, an attacker can splice PHP code after a valid prefix, close the PHP context, and traverse directories with ../ to drop a webshell. Stable on Linux only; requires CSRF to chain into admin context. The vulnerability is fixed in current Z-BlogPHP 1.7.3 Finch.
Code Audit: YXCMS 1.4.6 Vulnerability Collection
A retrospective audit of YXCMS 1.4.6 covering five vulnerability classes: stored XSS in the guestbook via array-based regex bypass, chained with CSRF to drop a PHP webshell, plus arbitrary file deletion, backend file write, and numeric SQL injection.
Code Audit: DedeCMS V5.7 SP2 Vulnerability Collection
A walkthrough of five vulnerabilities chained across DedeCMS V5.7 UTF8 SP2 (20180109): cookie forgery for arbitrary front-end user login, weak-typed comparison bypassing the security-question reset flow, front-end password change silently overwriting the back-end admin password, variable overwrite leading to arbitrary file deletion, and an inconsistent suffix-detection bypass in the back-end image uploader.
2017
XXE Learning Path: Step by Step
A step-by-step walkthrough of XML External Entity (XXE) injection — from DTD basics and entity declarations to in-band and out-of-band exploitation, covering file/http/php protocols, parameter entity OOB exfiltration, and the extended attack surface of schemaLocation, XInclude, and XSLT. Notes added on libxml2 evolution, PHP 8 defaults, and the OWASP Top 10 2021 merge into Security Misconfiguration.
A First Look at PHP Deserialization and POP CHAIN
PHP object deserialization remains a classic topic in Web security. Starting from a basic __destruct exploitation, this primer walks through cross-class data flow tracking to construct a POP CHAIN, then supplements the picture with phar stream wrapper deserialization, PHP 8's new __unserialize interface, and modern framework gadget chains like phpggc. A revised edition of the 2017 introductory write-up.
A Brief Summary of File Inclusion and PHP Pseudo Protocols
A systematic walkthrough of PHP file inclusion vulnerabilities and the common pseudo protocols (file://, php://filter, php://input, zip://, bzip2://, zlib://, data://) tested against every combination of allow_url_fopen and allow_url_include, with notes on the PHP 5.3.4 null-byte fix and modern PHP 7+/8.x hardening.
Thoughts from a CTF Challenge: A Few MySQL Quirks
A walk-through of a MySQL blind SQL injection CTF challenge, focusing on four often-overlooked MySQL behaviors: case-insensitive string comparison, numeric string equality, hex() returning a string, and char() returning a BINARY string. Covers using double hex() encoding to bypass filters and achieve case-sensitive blind injection, with a Python 3 automation script.
CVE-2017-9841 PHPUnit eval-stdin.php Remote Code Execution: When a PHP Testing Framework Becomes a Web Entry Point
CVE-2017-9841 is a pre-authentication remote code execution in PHPUnit's `eval-stdin.php` file, scored CVSS 9.8. The file is designed to accept PHP code through the CLI, but when the entire vendor directory is shipped to production it sits directly under the web root and turns a single unauthenticated POST into arbitrary code execution. The exposure pattern repeats across every PHP project that bundles dev dependencies into production: framework, CMS, package manager, or web root configuration. The fix is not just deleting the file — it is the six-piece baseline of delete + `composer --no-dev` + WAF block + periodic scan + CI/CD gate + yara rule, applied simultaneously.