Exploit development, vulnerability research & security writeups
A sensitive data exposure vulnerability in Wekan versions 8.31.0 through 8.33 allows any authenticated user to subscribe to the Meteor DDP publication "notificationUsers" and retrieve sensitive user documents including bcrypt password hashes, login session tokens, and email information due to missing authorization and field projection.
A Remote Code Execution vulnerability in zumba/json-serializer versions prior to 3.2.3 allows attackers to instantiate arbitrary PHP objects using the @type field during deserialization. If a suitable gadget chain exists in the application, this can lead to full Remote Code Execution.
A vulnerability in PyJWT versions prior to 2.12.0 allows JSON Web Tokens containing unknown critical header parameters to be accepted instead of rejected. This issue can lead to authentication bypass or security policy circumvention in applications relying on strict JWT validation.
A critical unauthenticated SQL Injection vulnerability (CVE-2026-31877) affecting Frappe Framework allows attackers to extract sensitive database information through improperly sanitized API parameters. This article provides a proof-of-concept exploit and technical overview.
A user enumeration vulnerability in NocoDB versions up to 0.301.2 allows attackers to determine whether an email address is registered by analyzing responses from the password reset endpoint. This issue may allow attackers to collect valid user accounts for further attacks.
A vulnerability in macOS LaunchDaemon configuration allows local attackers to hijack a system daemon and execute arbitrary commands with root privileges. This article demonstrates a proof-of-concept exploit that installs a root shell and persistent LaunchDaemon backdoor.
A Use-After-Free vulnerability in the JScript engine of Internet Explorer on Windows Server 2025 allows remote attackers to execute arbitrary code through a specially crafted webpage. This article demonstrates a proof-of-concept exploit that launches calc.exe to confirm code execution.
A vulnerability in Windows File Explorer causes NTLM authentication requests to be automatically triggered when extracting malicious .library-ms files from ZIP archives, potentially leaking NTLM hashes to an attacker-controlled SMB server.
A vulnerability in the WordPress User Registration & Membership plugin allows attackers to bypass authentication by abusing a vulnerable AJAX endpoint. This article demonstrates a proof-of-concept exploit targeting versions 4.1.2 and earlier.
A remote code execution vulnerability in the pymatgen CIF parser allows maliciously crafted CIF files to execute arbitrary system commands when parsed. This article demonstrates the vulnerability and provides a proof-of-concept exploit.