---
title: "Alireza Kalhor (@alirezakalhor) | Hashnode"
description: "Hacker. Read the latest articles by Alireza Kalhor on Hashnode."
url: "https://hashnode.com/@alirezakalhor"
---

@alirezakalhor

# Alireza Kalhor

@alirezakalhor · Joined November 2025

Hacker.

### [CVE-2026-17532: nonce: true => Web Shell](https://kalhor.hashnode.dev/cve-2026-17532-nonce-true-web-shell?utm_source=hashnode&utm_medium=feed)

Unauthenticated XSS in a WordPress caching plugin (50,000+ sites) chains into 1-click RCE via a PHP type-juggling bug. Write-up + PoC lab inside.

7 min read · [kalhor.hashnode.dev](https://kalhor.hashnode.dev/cve-2026-17532-nonce-true-web-shell?utm_source=hashnode&utm_medium=feed)

[Aug 25](https://hashnode.com/posts/cve-2026-17532-nonce-true-web-shell/6a8da410f2a515cc384a6475)

### [Taking over a password-protected & FDE enabled OVF for fun and profit](https://kalhor.hashnode.dev/taking-over-a-password-protected-fde-enabled-ovf-for-fun-and-profit?utm_source=hashnode&utm_medium=feed)

In this article we learn how to change the password of any Linux based systems including CUCM even when grub password is enabled.

17 min read · [kalhor.hashnode.dev](https://kalhor.hashnode.dev/taking-over-a-password-protected-fde-enabled-ovf-for-fun-and-profit?utm_source=hashnode&utm_medium=feed)

[Aug 22](https://hashnode.com/posts/taking-over-a-password-protected-fde-enabled-ovf-for-fun-and-profit/6a89c707a73cd3eff2db00d8)