CVE-2026-63277: LibreOffice Calc RCE via calcext:data-mappings, sql provider and jdbc connector —... high severity. Runnable script, captured output,...

Intro Something different this time. This post is based on a speech I’m giving on June 24th at Ya!vaConf in Poland. So, we will analyze WebGoat application which is written in Java to discover some vulnerabilities in the source code and then write an exploit using Python.

What is the main purpose of a Content Management System (CMS)? We have to accept that when we ask such existential and philosophical questions, we’re also admitting that we have no idea and that there probably isn’t an easy answer (this is our excuse, and we’re sticking

Learn how CVE-2026-20230 enables Cisco Unified CM pre-auth RCE through WebDialer SSRF, exploit analysis, and mitigation steps

We could have pwned every Metabase Cloud tenant by chaining an H2 INIT sanitizer bypass into RCE, then cloud misconfigurations into a full multi-tenant cluster compromise.

Writeup of a collaborated bug on Bugcrowd where I was able to bypass Akamai WAF to exploit RCE on Spring Boot error page using SpEL

A Journey of Limited Path Traversal To RCE With $40,000 Bounty! #Introduce Myself: My Name is Abdullah Nawaf, Full Time Bug Bounty Hunter, Working actively in BugCrowd with a Top 50 Rank, Rank 11 for …

Note: In correspondence with Hexagon while disclosing the bugs below, they informed us that any sharing of source code would be considered a violation of their terms and license. The Java code has been replaced with similar code that illustrates the flow of the application and names have been changed. It seems that vulnerability research

It's been more than six months since the Log4Shell vulnerability (CVE-2021-44228) was disclosed, and a number of post-mortems have come out talking about lessons learned and ways to prevent the next Log4Shell-type event from happening.

CVE-2022-28219 is an unauthenticated remote code execution vulnerability affecting Zoho ManageEngine ADAudit Plus, a compliance tool used by enterprises to monitor changes to Active Directory. The vulnerability comprises several issues: untrusted Java deserialization, path traversal, and a blind XML External Entities (XXE) injection. This is a vulnerability that NodeZero, our autonomous pentesting product, has exploited […]

Translated version ( Russian version ) is in the comments hello boys, This is my first post in the forum and in the contest, so I wanted to make it something good. Sorry I am writing this article in English but If you have any question or anything unclear don't hesitate to ask me and I will...

0x01 ForewordsRecently I see some discussions about arbitrary file upload in Java environment on Internet. The main takling points are how to bypass file name detection when uploading arbitrary file.

Server-Side Template Injection isn't exactly a new vulnerability in the world of web applications. It was made famous in 2015 by James Kettle in his famous blogpost on PortSwigger blog. In this post, …