← Research
web
5 write-ups tagged web.
androidapplechromecloudcryptofreebsdlinuxmadbugsphpransomwarereversingsafarisamsungwebwindowszero-click
August 12, 2024
Wormable Substack XSS
A cross-site scripting bug on Substack that could have spread on its own.
July 16, 2024
Type confusion attacks in ProseMirror editors
A rich-text editor that trusts its own JSON turns a document into script execution.
September 14, 2023
CraftCMS RCE
Chaining a file write into remote code execution on CraftCMS.
July 27, 2023
Reproducing CVE-2023-38646: Metabase Pre-auth RCE
Walking a pre-auth remote code execution bug back from the patch.
April 28, 2023
Redash SAML Authentication Bypass
Signing in as any user on a self-hosted Redash, with no password.