Security Research

One advisory. Five stages. Countless rabbit holes. 💀 From OSINT to AI steganography, reverse engineering, cryptography, and GitHub forensics. The Forgotten Access — where finding one clue only unlocks another problem. 😭 And some of you thought it was just a simple CTF. 💀

High-severity hardcoded credentials vulnerability in the CP Plus CP-XR-DE21-S Router allows an attacker with local network access to obtain shared HTTP Digest authentication credentials and gain unauthorized administrative access.

Path traversal in mistune's Include directive allows reading arbitrary files outside the intended markdown directory. Affects all versions up to 3.1.4, fixed in 3.3.0.

A methodical walkthrough of an AD attack chain — from unauthenticated recon to full domain compromise via AS-REP roasting, DCSync, and pass-the-hash.

High-severity Firebase and Web3Forms API credential exposure in Nexulean Website through publicly accessible client-side resources. Fixed in v2.0.0.

High-severity missing rate limiting on the Quantum Networks Router login endpoint allows unlimited brute-force and credential stuffing attacks against administrative accounts.

Information disclosure vulnerability in Quantum Networks Router due to missing authentication on sensitive internal endpoints, allowing unauthenticated access to internal API paths, scripts, and configuration resources.

High-severity sandbox escape in OpenLearnX's Python execution environment allows crafted payloads to break out of the restricted runtime and execute arbitrary commands on the host.

Persistent Denial of Service in Kirby CMS via malformed image upload. An authenticated Editor can crash the application into an unrecoverable state by exploiting unchecked getimagesize() return values.

High-severity OS command injection in protobufjs-cli's pbts tool. User-supplied file paths are string-interpolated into a shell command and executed via child_process.exec(), enabling arbitrary command execution via crafted filenames.

High-severity OS command injection in uniget CLI where the check field from JSON metadata is passed directly to /bin/bash -c without validation, enabling arbitrary command execution via crafted metadata files.

Unsafe EDITOR environment variable parsing in uniget CLI v0.27.3 via strings.Split() allows unintended argument injection and command execution.

High-severity vulnerability in NexTOR IP Changer where sudo combined with shell-based execution could allow privileged command execution in permissive sudo configurations.

High-severity PATH injection vulnerability in NexTOR IP Changer where unsafe executable resolution through the PATH environment variable could allow arbitrary command execution.

Path traversal vulnerability in uniget CLI v0.27.3 allows local users to access and modify arbitrary files via directory escape sequences in hook filenames.

An Electron application's IPC handler accepted attacker-controlled destination URLs from the renderer process, enabling full credential and system data exfiltration to arbitrary external endpoints via a single IPC message.