Daily Writeups
@Daily_Writeups
4.02K subscribers
4 photos
136K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.02K subscribers
Daily Writeups
⤷ Title: Symantec Endpoint Management Alert: Critical Flaw Allows Unauthenticated RCE, PoC Releases
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 14 Jul 2025 10:58:57 +0000
════════════════════════
⌗ Tags: #Vulnerability #Altiris #cybersecurity #Endpoint Management #Insecure Deserialization #rce #Remote Code Execution #Symantec
Daily CyberSecurity
Symantec Endpoint Management Alert: Critical Flaw Allows Unauthenticated RCE, PoC Releases
A critical RCE flaw (CVE-2025-5333) in Symantec Endpoint Management (Altiris) allows unauthenticated attackers to execute arbitrary code via insecure .NET Remoting deserialization.
28 views
Daily Writeups
⤷ Title: High-Severity Vault Flaw (CVE-2025-13357) Allows Unauthenticated Access via LDAP Null Bind Insecure Default
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 25 Nov 2025 00:36:50 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authentication Bypass #CVE_2025_13357 #HashiCorp Vault #Insecure Default #LDAP #Terraform Provider
Daily CyberSecurity
High-Severity Vault Flaw (CVE-2025-13357) Allows Unauthenticated Access via LDAP Null Bind Insecure Default
A High-severity flaw (CVE-2025-13357, CVSS 7.4) in the Vault Terraform Provider allows unauthenticated access via LDAP null binds due to an insecure deny_null_bind default setting. Update to v5.5.0.
37 views
Daily Writeups
⤷ Title: Broken Object Level Authorization (BOLA): The API Vulnerability Bankrupting Companies
════════════════════════
𐀪 Author: InstaTunnel
════════════════════════
ⴵ Time: Wed, 26 Nov 2025 12:01:25 GMT
════════════════════════
⌗ Tags: #api_security #owasp_api_top_10 #insecure_object_reference #api_bola_attack #bola_vulnerability
Medium
Broken Object Level Authorization (BOLA): The API Vulnerability Bankrupting Companies 🔓
44 views
Daily Writeups
⤷ Title: Insecure Deserialization — Overview
════════════════════════
𐀪 Author: Yassin Khadrawy
════════════════════════
ⴵ Time: Mon, 08 Dec 2025 21:30:10 GMT
════════════════════════
⌗ Tags: #penetration_testing #insecure_deserialization #pentesting #cybersecurity #insecurity
Medium
Insecure Deserialization — Overview
Serialization and deserialization are common operations in modern web applications. But when misused, they open the door to one of the…
23 views
Daily Writeups
⤷ Title: Windows Admin Center Flaw (CVE-2025-64669): How a Simple Folder Permission Opened the Door to SYSTEM Access
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 17 Dec 2025 00:31:01 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2025_64669 #DLL hijacking #Insecure Permissions #LPE #privilege escalation #TOCTOU #WAC #Windows Admin Center
Daily CyberSecurity
Windows Admin Center Flaw (CVE-2025-64669): How a Simple Folder Permission Opened the Door to SYSTEM Access
A LPE flaw in Windows Admin Center allows any user to gain SYSTEM privileges. It exploits insecure directory permissions and a TOCTOU flaw to execute a DLL hijacking attack.
23 views
Daily Writeups
⤷ Title: AI’s Exposed Side Door: Dify Flaw (CVE-2025-63387) Leaks System Configs to Anonymous Users
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 22 Dec 2025 00:01:55 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI security #API security #CVE_2025_63387 #DevSecOps #Dify #Information Disclosure #Insecure Permissions #LLM #open_source #Vulnerability
Daily CyberSecurity
AI’s Exposed Side Door: Dify Flaw (CVE-2025-63387) Leaks System Configs to Anonymous Users
A High-severity flaw (CVE-2025-63387) in Dify v1.9.1 allows unauthenticated users to access sensitive system configurations via an unprotected API.
17 views
Daily Writeups
⤷ Title: Tryhackme: React2Shell
════════════════════════
𐀪 Author: sagar ujalambkar
════════════════════════
ⴵ Time: Wed, 31 Dec 2025 06:12:16 GMT
════════════════════════
⌗ Tags: #reactjs #insecure_deserialization #cve_2025_55182 #tryhackme #websecurity_testing
Medium
Tryhackme: React2Shell
What is React2Shell Vulnerability? This vulnerability affects React Server Components (RSC) and the frameworks that implement them…
12 views
Daily Writeups
⤷ Title: The Complete Guide to ASP.NET ViewState Exploitation
════════════════════════
𐀪 Author: Dipesh Paul
════════════════════════
ⴵ Time: Thu, 15 Jan 2026 14:45:10 GMT
════════════════════════
⌗ Tags: #rce #insecure_deserialization #cybersecurity #aspnetcore #hacking
Medium
The Complete Guide to ASP.NET ViewState Exploitation
How I spent hours trying to exploit ViewState deserialization, failed spectacularly, and learned valuable lessons about ASP.NET security in…
15 views
Daily Writeups
⤷ Title: Insecure CaptchaVulnerability Analysis in DVWA (Low to Impossible)
════════════════════════
𐀪 Author: Narathama Firmansyah Putra
════════════════════════
ⴵ Time: Sun, 15 Feb 2026 14:27:37 GMT
════════════════════════
⌗ Tags: #penetration_testing #dvwa #insecure_captcha #cybersecurity #captcha
Medium
Insecure CaptchaVulnerability Analysis in DVWA (Low to Impossible)
Introduction Insecure Captcha adalah salah satu fitur latihan keamanan di Damn Vulnerable Web Application (DVWA) yang menunjukkan bagaimana…
35 views
Daily Writeups
⤷ Title: HTB: Outbound
════════════════════════
𐀪 Author: bluesnow
════════════════════════
ⴵ Time: Tue, 17 Feb 2026 07:42:30 GMT
════════════════════════
⌗ Tags: #roundcube #rce #below #insecure_deserialization #symlink_attack
Medium
HTB: Outbound
| Roundcube | PHP Deserialization | CVE-2025–49113 | 3DES Hash Decryption | Below | Symlink Attack |
29 views
Daily Writeups
⤷ Title: OWASP Top 10: 2025—The Latest in Web Application Security Risks
════════════════════════
𐀪 Author: XCyber
════════════════════════
ⴵ Time: Sun, 22 Feb 2026 17:13:14 GMT
════════════════════════
⌗ Tags: #owasp_top_10 #cybersecurity #insecure_design #web_application_security #sql_injection
Medium
OWASP Top 10: 2025—The Latest in Web Application Security Risks
OWASP Top 10: 2025 — The Latest in Web Application Security Risks
47 views
Daily Writeups
⤷ Title: Critical 10.0 CVSS Flaw in Cisco Secure FMC Hands Hackers Root Access to Enterprise Firewalls
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 05 Mar 2026 01:37:24 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Cisco Secure FMC #CVE_2026_20131 #CVSS 10.0 #firewall security #infosec #Insecure Deserialization #Patch Alert #Remote Code Execution #unauthenticated RCE #Vulnerability
Daily CyberSecurity
Critical 10.0 CVSS Flaw in Cisco Secure FMC Hands Hackers Root Access to Enterprise Firewalls
A critical 10.0 CVSS unauthenticated RCE flaw (CVE-2026-20131) in Cisco Secure FMC allows hackers root access via insecure Java deserialization. Patch now.
29 views
Daily Writeups
⤷ Title: Critical Alert: SAP’s Latest Security Update Fixes 9.8 CVSS RCE and Deserialization Flaws
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 10 Mar 2026 07:20:40 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2019_17571 #CVE_2026_27685 #cybersecurity #Enterprise Security #infosec #Insecure Deserialization #Patch Tuesday #Remote Code Execution #SAP Security #Vulnerability
Daily CyberSecurity
Critical Alert: SAP's Latest Security Update Fixes 9.8 CVSS RCE and Deserialization Flaws
SAP's latest security update addresses 15 flaws, including critical RCE (CVE-2019-17571) and deserialization (CVE-2026-27685) vulnerabilities. Patch now.
16 views
Daily Writeups
⤷ Title: CVE-2026-34838 (CVSS 10): Critical RCE Flaw Uncovered in GroupOffice CRM
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 14:03:22 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CRM Security #CVE_2026_34838 #GroupOffice #Guzzle #infosec #Insecure Deserialization #PHP Security #POP Chain #rce #Vulnerability Research #Web Shell
Daily CyberSecurity
CVE-2026-34838 (CVSS 10): Critical RCE Flaw Uncovered in GroupOffice CRM
CVE-2026-34838: A critical 10.0 flaw in GroupOffice allows authenticated users to trigger RCE via insecure deserialization. Update to v26.0.12 immediately!
19 views
Daily Writeups
⤷ Title: Unauthenticated RCE via WebLogic WLS-WSAT (CVE-2019–2725)
════════════════════════
𐀪 Author: Sai
════════════════════════
ⴵ Time: Fri, 08 May 2026 08:02:20 GMT
════════════════════════
⌗ Tags: #insecure_deserialization #oracle_weblogic_server #vulnerability #application_security #remote_code_execution
Medium
Unauthenticated RCE via WebLogic WLS-WSAT (CVE-2019–2725)
Overview
10 views
Daily Writeups
⤷ Title: Remote Code Execution via Insecure Deserialization in Wazuh XDR/SIEM (CVE-2026–25769)
════════════════════════
𐀪 Author: Kevin Dicks
════════════════════════
ⴵ Time: Sun, 10 May 2026 22:24:11 GMT
════════════════════════
⌗ Tags: #cve #insecure_deserialization #rce
Medium
Remote Code Execution via Insecure Deserialization in Wazuh XDR/SIEM (CVE-2026–25769)
Abstract
27 views
Daily Writeups
⤷ Title: OWASP Top 10 #4: Insecure Design — When Applications Are Built Insecurely from the Beginning
════════════════════════
𐀪 Author: Kanishkakhandelwal
════════════════════════
ⴵ Time: Mon, 11 May 2026 12:21:16 GMT
════════════════════════
⌗ Tags: #insecure_design #owasp_top_10 #bug_bounty #vapt #vulnerability_assessment
Medium
OWASP Top 10 #4: Insecure Design — When Applications Are Built Insecurely from the Beginning
Hello, I’m Kanishka Khandelwal, an Application Security Engineer and security researcher focused on web & API security testing, bug bounty…
21 views
Daily Writeups
⤷ Title: Critical TYPO3 Extension Exploit: Content Element Selector Flaw (CVE-2026-46725) Triggers Unauthenticated RCE
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 25 May 2026 01:17:26 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ceselector #Content Element Selector #CVE_2026_46725 #Cyber Security #infosec #Insecure Deserialization #Patch Alert #PHP Object Injection #Remote Code Execution #TYPO3 Extension #TYPO3_EXT_SA_2026_013
Daily CyberSecurity
Critical TYPO3 Extension Exploit: Content Element Selector Flaw (CVE-2026-46725) Triggers Unauthenticated RCE
Urgent: TYPO3 patches a critical 9.2 CVSS flaw (CVE-2026-46725) in Content Element Selector plugin. Unauthenticated attackers can achieve full server RCE.
21 views
Daily Writeups
⤷ Title: [IronHold] — Spring Boot Source Code Analysis: Finding Credentials, SQL Injection, PrivEsc, and…
════════════════════════
𐀪 Author: Bash Overflow
════════════════════════
ⴵ Time: Thu, 23 Jul 2026 05:38:52 GMT
════════════════════════
⌗ Tags: #capture_the_flag #spring_boot #sql_injection #insecure_deserialization #privilege_escalation
Medium
[IronHold] — Spring Boot Source Code Analysis: Finding Credentials, SQL Injection, PrivEsc, and Java Deserialization Exploitation
The source leaked. Read it like an attacker, chain the flaws, and compromise the Spring Boot application.
32 views
Daily Writeups
⤷ Title: Jax Sucks Alot (THM) Walkthrough
════════════════════════
𐀪 Author: L4ZZ3RJ0D
════════════════════════
ⴵ Time: Fri, 18 Sep 2026 09:25:10 GMT
════════════════════════
⌗ Tags: #ctf #tryhackme_walkthrough #info_sec_writeups #tryhackme #insecure_deserialization
Medium
Jax Sucks Alot (THM) Walkthrough
“In JavaScript, everything is a terrible mistake.” Horror LLC said it themselves, right there in the brief, and by the end of this room I…
27 views