3 writeups in this category.
A detailed lab note on turning Prototype Pollution into code execution through Pug's AST/code-generation path: vulnerable merge, prototype chain behavior, debugger observations, exploit shape, trigger conditions and defenses.
2026-05-17A deep dive into CVE-2026-35616 — the FortiClient EMS authentication bypass. The Django CertChainAuth middleware blindly trusts the X-SSL-CLIENT-VERIFY HTTP header, so any unauthenticated client can spoof a verified-client-certificate state and walk straight past the auth gate. Full root-cause analysis, a 401→500 detection oracle, an unauthenticated 225 KB data-disclosure endpoint, a read-only enumeration PoC, and remediation.
2026-05-13A full breakdown of CVE-2025-54309 — the CrushFTP zero-day exploited in the wild in July 2025. A logic flaw in loginCheckHeaderAuth() lets a crafted AS2-To header skip authentication entirely, after which an attacker creates an admin account, remaps the Virtual File System to the OS root, drops a malicious Java plugin and reaches remote command execution. Root cause, the bypass-to-RCE kill chain, detection IOCs and remediation.
2025-08-02