Most bug bounty discoveries don’t begin with an advanced exploit.
No SQL Injection.
No authentication bypass.
No complex exploit chain…

TL;DR Splunk released patches on July 15, 2026 for three Splunk Enterprise vulnerabilities. The most serious, CVE-2026-20296, is a cross-site request forgery (CSRF) flaw that enables SPL execution…

Introduction: The Target Scope

As a Computer Science student specializing in Cybersecurity & AI, I’ve been spending a lot of time learning and practicing web security…

can XSS steal username and password without cookie ?!

CSRF Introduction: A Practical Walkthrough with TryHackMe Note: This walkthrough is based on the TryHackMe CSRF Introduction room. I have intentionally skipped the first four tasks because they focus …

The admin never touched the dashboard, but the order status changed anyway

TL;DR GitLab shipped an out-of-band critical patch on August 17, 2026. It fixes CVE-2026-19478, a GraphQL code injection flaw rated CVSS 9.4. Under certain conditions, an unauthenticated attacker …

Introduction

Cross-Site Request Forgery (CSRF) is a web vulnerability that allows an attacker to trick an authenticated user’s browser into sending an…

A beginner-friendly walkthrough of the TryHackMe CSRF room, covering CSRF attack techniques , Exploitation methods

A single link in an attacker’s hands can make WordPress install a theme without a button being pressed, provided an already-authenticated administrator opens it. On September 17, WordPress r…

A seemingly innocuous link possesses the terrifying potential to transform an active WordPress administrator session into a devastating site takeover mechanism. Cybersecurity researchers recently …

SQL Injection vs. XSS vs. CSRF: 1 Million Users in 20 Hours and a £400,000 Fine

During a web security assessment, I examined how an application handled user sessions and authentication-related actions. While testing the…

This labs takes my time because i stuck in that URL encode part so lets starts how i solved this lab.

How a textbook-secure application, CSRF tokens, SameSite cookies, strict CORS, and a WAF, fell to a single HTML file

بسم الله الرحمن الرحيم — وَمَا بِكُم مِّن نِّعْمَةٍ فَمِنَ اللَّهِ