--- title: "Tuannq (@tuannq2299) | Hashnode" description: "Application Security Engineer" url: "https://hashnode.com/@tuannq2299" --- @tuannq2299 # Tuannq @tuannq2299 · Joined March 2023 ### [From Privilege Escalation to RCE in Wiki.js](https://blogs.night-wolf.io/from-privilege-escalation-to-rce-in-wiki-js?utm_source=hashnode&utm_medium=feed) A tale of privilege escalation, command injection, and the humbling art of responsible disclosure 11 min read · [blogs.night-wolf.io](https://blogs.night-wolf.io/from-privilege-escalation-to-rce-in-wiki-js?utm_source=hashnode&utm_medium=feed) [May 21](https://hashnode.com/posts/from-privilege-escalation-to-rce-in-wiki-js/6a0e638a8b03460221d20981) ### [\[ZVE-2025-3566\] Stored XSS to RCE in Manage Engine OpManager](https://blogs.night-wolf.io/zve-2025-3566-stored-xss-to-rce-in-manage-engine-opmanager?utm_source=hashnode&utm_medium=feed) Discover how a stored XSS vulnerability in Manage Engine OpManager was escalated to achieve remote code execution (RCE) 3 min read · [blogs.night-wolf.io](https://blogs.night-wolf.io/zve-2025-3566-stored-xss-to-rce-in-manage-engine-opmanager?utm_source=hashnode&utm_medium=feed) [Jul 30, 2025](https://hashnode.com/posts/zve-2025-3566-stored-xss-to-rce-in-manage-engine-opmanager/6889f679c337e39ab96b6838) ### [\[CVE-2022-4582\] Unauth. SQL Injection vulnerability in Advanced Booking Calendar plugin ≤1.7.1 on Wordpress](https://blogs.night-wolf.io/cve-2022-4582-unauth-sql-injection-vulnerability-in-advanced-booking-calendar-plugin-171-on-wordpress?utm_source=hashnode&utm_medium=feed) 1\. Giới thiệu về CVE-2022-4582 WordPress là một hệ thống mã nguồn mở dùng để xuất bản blog/website được viết bằng ngôn ngữ lập trình PHP và cơ sở dữ liệu MySQL. WordPress được biết đến như một CMS miễn phí nhưng tốt, dễ sử dụng và phổ biến nhất trên ... 4 min read · [blogs.night-wolf.io](https://blogs.night-wolf.io/cve-2022-4582-unauth-sql-injection-vulnerability-in-advanced-booking-calendar-plugin-171-on-wordpress?utm_source=hashnode&utm_medium=feed) [Mar 19, 2023](https://hashnode.com/posts/cve-2022-4582-unauth-sql-injection-vulnerability-in-advanced-booking-calendar-plugin-171-on-wordpress/64171caf8c5ad4cb25cf2df0)