Hello everyone 👋

Finding SQL Injection

How a classic SQL injection flaw led to SYSTEM-level compromise through Oracles Java engine

firstly we explain what of the Insecure direct object references???

Friend Link

How an attacker-controlled Galera node name resulted in arbitrary OS command execution across cluster members.

(“Every Smali File Tells a Story… If You Know How to Read It”)

this is the second bug bounty received by Proton 🔥

This one has a twist in it, so bear with the setup. The bug wasn’t hard to find. Getting it accepted was the actual fight.

How a missing validation check in Galera’s SST implementation allowed authenticated OS command execution.

10,000 subdomains is not recon. It’s noise. Here is the pipeline that turns raw output into testable findings.

A practical guide to fingerprinting technology stacks at scale — and why one tiny, forgotten image file can leak more about a target’s…

The Setup

While testing the authentication functionality on redacted.com, I came across something quite interesting involving the combination of…

Introduction

A Tale of Broken Access Control

🚀 PoC Vault is Now Live!

The password was present.

TL;DR A Linux kernel use-after-free in SCTP, tracked as CVE-2026-64564, allows local attackers to gain root. Researchers demonstrated privilege escalation and container-to-host escape on five dist…

TL;DR CVE-2026-63077 is a critical unauthenticated remote code execution flaw in JetBrains TeamCity. An attacker who reaches the server can run OS commands without credentials. CISA confirmed the …