AArshadinblog.arshadakl.in·Sep 5 · 6 min readHow a Profile Update Feature Could Drain a Company's Bank AccountI was looking at one of the most normal features you can find in almost any application: Update Profile. Nothing exciting. A user changes their name, profile picture, maybe email, and the backend upda00
AKAlireza Kalhorinkalhor.hashnode.dev·Aug 25 · 7 min readCVE-2026-17532: nonce: true => Web ShellUnauthenticated reflected XSS to 1-click RCE in Seraphinite Accelerator, a WordPress caching plugin on 50,000+ sites. The site that looked clean What would you do if I told you that just by opening y00
ZZeroProtocolinwebpentestingdeepdive.hashnode.dev·Aug 13 · 7 min readCommon Web Application TechnologiesIntroduction Modern web applications are rarely built with a single technology. A typical application combines a web server, a programming language, a framework, a database, data formats, and backend 10
SSunnyincybersecurity-learning.hashnode.dev·Jul 28 · 14 min readTryHackMe Vulnerabilities 101 Beginner-Friendly Learning GuideIntroduction I recently completed the Vulnerabilities 101 room on TryHackMe as part of my ongoing cybersecurity learning journey. Vulnerabilities are one of the most important concepts in cybersecurit00
Rrathsarainrr-cyber.hashnode.dev·May 19 · 11 min readBuilding The Technical Foundation For Continuous Vulnerability VisibilityThis is the second article in the series. The first one covered why our periodic scanning model had stopped working at scale. This one is the technical account of what we built in its place. A quick n10
Rrathsarainrr-cyber.hashnode.dev·May 16 · 6 min readThe Vulnerability Scanning Model That Stopped Working at ScaleMost vulnerability management programmes are designed to produce reports, not to maintain a continuously answerable state of exposure. Ours was one of them. We had a working Qualys deployment and no o00
ASaviral srivastavainaviraxroot.hashnode.dev·Mar 29 · 10 min readI Found 5 Security Vulnerabilities in XGBoost. Here's What Happened.XGBoost is one of the most important libraries in machine learning. 26,000+ GitHub stars. Used by banks for fraud detection, insurance companies for risk modeling, tech companies for ranking systems, 00
ASaviral srivastavainaviraxroot.hashnode.dev·Mar 16 · 13 min readI Found a SQL Injection in an AI Agent. It Taught Me That We Broke the First Rule of Database Security.I was two hours into auditing AnythingLLM when I stopped scrolling and stared at my screen for a good ten seconds. Not because the code was complex. Because it was the opposite. javascript getTableSch00
Aaivr-bloginaivr.hashnode.dev·Jan 14 · 7 min readAwesomeBot meets Prompt InjectionIntro AwesomeBot is an awesome AI Chatbot! It was vibe coded from scratch to have a ton of awesome features without much security in mind so various attacks and offensive methods can be demonstrated. This series of blog posts serves as a way to under...00
Aaivr-bloginaivr.hashnode.dev·Jan 2 · 3 min readNanoMQ Rule Engine Remote Buffer OverflowSummary A stack-based buffer overflow vulnerability exists in NanoMQ version 0.24.6, allowing remote attackers to cause a Denial of Service (DoS) and potentially achieve Remote Code Execution (RCE). The vulnerability requires admin privileges, but us...00
