Latest

One advisory. Five stages. Countless rabbit holes. 💀 From OSINT to AI steganography, reverse engineering, cryptography, and GitHub forensics. The Forgotten Access — where finding one clue only unlocks another problem. 😭 And some of you thought it was just a simple CTF. 💀

High-severity hardcoded credentials vulnerability in the CP Plus CP-XR-DE21-S Router allows an attacker with local network access to obtain shared HTTP Digest authentication credentials and gain unauthorized administrative access.

A security-focused analysis of how AI agents, tool integrations, prompts, memory, and delegated permissions can create new attack paths across modern applications.

How inconsistent email normalization between the rate limiter and delivery logic allows unlimited OTP requests — a classic normalization-mismatch bug.

Path traversal in mistune's Include directive allows reading arbitrary files outside the intended markdown directory. Affects all versions up to 3.1.4, fixed in 3.3.0.

A methodical walkthrough of an AD attack chain — from unauthenticated recon to full domain compromise via AS-REP roasting, DCSync, and pass-the-hash.

High-severity Firebase and Web3Forms API credential exposure in Nexulean Website through publicly accessible client-side resources. Fixed in v2.0.0.

High-severity missing rate limiting on the Quantum Networks Router login endpoint allows unlimited brute-force and credential stuffing attacks against administrative accounts.

Information disclosure vulnerability in Quantum Networks Router due to missing authentication on sensitive internal endpoints, allowing unauthenticated access to internal API paths, scripts, and configuration resources.

Moderate-severity DOM-based cross-site scripting in IP Reputation Checker where insufficient sanitization of user-controlled input before DOM insertion allows arbitrary script execution in the victim's browser.