Tag

#application-security

334 posts53 followers

Explore Hashnode

Alternatives

vidit4h ago · 19 min read

PHP2Shell: Two Critical PHP Flaws That Could Turn a Website Into an Attacker’s Entry Point

The Internet Has a PHP Problem Imagine visiting your favourite website, logging into your account, or making an online payment. Everything looks normal. There is no suspicious download, no malicious a

viditp.hashnode.dev

Milan Nikic1d ago · 18 min read

XML external entity injection: A security architect's perspective (Part 2)

In Part 1 of this series, we examined XXE injection from a developer's perspective, covering secure coding patterns across DocumentBuilderFactory, SAXParser, StAX, TransformerFactory, JAXB, and Jackso

securitydepth.hashnode.dev

Dimakatso Sebatane4d ago · 9 min read

Case Study: Cross-Tenant Data Exfiltration via Backup Restore

Category: Web Application SecurityVulnerability: Broken Object Level Authorization (BOLA / IDOR)CWE: CWE-639 — Authorization Bypass Through User-Controlled KeyOWASP: API1:2023 — Broken Object Level Au

ovawatch-security.hashnode.dev

Kazem MortazaviOct 15 · 4 min read

Web Application Scanning: How to Match the Tool to Your Organization

Choosing a web application scanner often starts with the wrong question. Teams compare feature lists, the table fills up with checkmarks, and nobody has agreed on how many applications the organizatio

securityland.hashnode.dev

M1HOct 13 · 12 min read

How I Got My First Official High Severity CVE That Leads to Admin Account Hijacking

Overview: My security audit of Grav CMS, one of the most popular flat-file content management systems resulted in the responsible disclosure of CVE-2026-92916, with a CVSS v4 score of 8.7 (High). The

m1h.hashnode.dev

Milan NikicOct 12 · 24 min read

XML external entity injection: Secure coding in Java

XML External Entity injection remains a persistent threat in enterprise applications. According to the OWASP Top 10 2025, XXE falls under A02:2025 Security Misconfiguration (CWE-611), reflecting that

securitydepth.hashnode.dev

Oluwaseyi FatunmoleOct 5 · 27 min read

The Engineering Anatomy of API Vulnerabilities: A Deep Dive into the OWASP API Security Top 10

Most security articles read like threat reports. They describe vulnerabilities from the outside looking in: what an attacker does, what the impact is, and how many systems are affected globally. That'

freecodecamp.org

Prasad GOct 2 · 5 min read

Why LLM Agents Need a New Security Layer: Understanding AI-Native Firewalling

AI applications are changing from systems that simply generate responses into systems that can take actions. An LLM-powered application can retrieve information, call APIs, interact with tools, access

prasadprechu.hashnode.dev

M1HSep 29 · 6 min read