A critical ONLYOFFICE ownCloud plugin SSRF vulnerability allows authenticated administrators to force arbitrary network requests. This flaw affects version 9.12 of the integration plugin. Currentl…

TL;DR Ivanti patched eight vulnerabilities in its Neurons for ITSM platform, including five rated Critical with CVSS scores up to 9.9. Three of the flaws allow unauthenticated remote code executio…

TL;DR Security firm Calif built WeWorm, the first zero-click worm to propagate through WeChat voice calls on both iOS and Android. A single unanswered call can hijack the victim’s account wi…

After poking with firebase R/W

I found a Broken Access Control vulnerability that could let one restaurant modify another restaurant’s delivery zones.

Series: Web3 Security Zero se Advance 🛡️ | Article #22 By HackerMD | 32 min read

Hi, I’m El7xoot, a Bug Hunter and Security Researcher focused on web applications and APIs.

Hi, I’m el7xoot, a Bug Hunter and Security Researcher focused on web applications and APIs.

Hi folks,

A regex scan of a real skills corpus, and the difference between a flag and a finding.

A critical vulnerability is putting thousands of online stores at risk.

Classification: Critical — same-block, attacker-controlled mark used as collateral oracle Incident window: 21:26 UTC 5 September 2026 →…

For a bit of time, the public debate around artificial intelligence safety sounded like science fiction. What happens if an AI develops its…

A new federal framework gives vetted private companies a route to support operations against foreign cyber-enabled criminal groups. The…

Burp intercepts. curl scripts. Used together, they cover what neither does alone.

I started the Corridor room with a basic Nmap scan. Here’s how I worked through it and what I tried along the way.

Room: tryhackme.com/room/checkmate

Researchers at Calif developed the first zero-click worm for WeChat. This WeChat zero-click worm spreads through automated calls across iOS and Android platforms. Tencent has already mitigated thi…

Fortinet disclosed three high-severity security flaws affecting FortiMonitor, FortiSandbox, and FortiPAM today. These Fortinet vulnerabilities allow unauthorized access to sensitive corporate data…