Tuannq (@tuannq2299)

From Privilege Escalation to RCE in Wiki.js

A tale of privilege escalation, command injection, and the humbling art of responsible disclosure

11 min readblogs.night-wolf.io

May 21

[ZVE-2025-3566] Stored XSS to RCE in Manage Engine OpManager

Discover how a stored XSS vulnerability in Manage Engine OpManager was escalated to achieve remote code execution (RCE)

3 min readblogs.night-wolf.io

Jul 30, 2025

[CVE-2022-4582] Unauth. SQL Injection vulnerability in Advanced Booking Calendar plugin ≤1.7.1 on Wordpress

1. Giới thiệu về CVE-2022-4582 WordPress là một hệ thống mã nguồn mở dùng để xuất bản blog/website được viết bằng ngôn ngữ lập trình PHP và cơ sở dữ liệu MySQL. WordPress được biết đến như một CMS miễn phí nhưng tốt, dễ sử dụng và phổ biến nhất trên ...

4 min readblogs.night-wolf.io

Mar 19, 2023

Tuannq

About

Available for

Tuannq's blogs

From Privilege Escalation to RCE in Wiki.js

[ZVE-2025-3566] Stored XSS to RCE in Manage Engine OpManager

[CVE-2022-4582] Unauth. SQL Injection vulnerability in Advanced Booking Calendar plugin ≤1.7.1 on Wordpress

Tuannq

About

Available for

Tuannq's blogs

From Privilege Escalation to RCE in Wiki.js

[ZVE-2025-3566] Stored XSS to RCE in Manage Engine OpManager

[CVE-2022-4582] Unauth. SQL Injection vulnerability in Advanced Booking Calendar plugin ≤1.7.1 on Wordpress

Tuannq

About

Available for

Tuannq's blogs

From Privilege Escalation to RCE in Wiki.js

[ZVE-2025-3566] Stored XSS to RCE in Manage Engine OpManager

[CVE-2022-4582] Unauth. SQL Injection vulnerability in Advanced Booking Calendar plugin ≤1.7.1 on Wordpress

Search Hashnode

Tuannq

About

Available for

Tuannq's blogs

From Privilege Escalation to RCE in Wiki.js

[ZVE-2025-3566] Stored XSS to RCE in Manage Engine OpManager

[CVE-2022-4582] Unauth. SQL Injection vulnerability in Advanced Booking Calendar plugin ≤1.7.1 on Wordpress