CyberSec Notes

TL;DR — A single QUIC STREAM frame with zero payload and the FIN bit set is enough to trick HAProxy into forwarding a Content-Length: N request with zero body bytes to the backend.

RESPONSIBLE DISCLOSURE NOTICE This vulnerability was reported to Node.js through their HackerOne program.

Disclosure note: The issue described here has been fixed by the vendor.

Disclosed: September 9, 2025 Product: listmonk — self‑hosted newsletter & mailing‑list manager CVE: CVE-2025-58430 Project context listmonk is a widely used open‑source project for self‑hosted newsletters and mailing lists.

Ethical note: the following is for educational purposes and documents a real case in an authorized context (bug bounty).

About Me: In the last 2 months I have been focusing on finding vulnerabilities on Wordpress plugins and i got more than 100 CVEs In this post I will show and explain some of the most interesting vulnerabilities found, I will try to explain everything in d…

Easy Mergers v0.1 Challenge category : web Description : Tired of getting your corporate mergers blocked by the FTC?

CVE-2024-32491 | File upload path traversal to RCE Overview Date : 2024-04-17 Affected : All versions of Znuny and Znuny LTS from 6.0.31 up to and including 6.5.7.

eXXStravaganza For the eXXStravaganza series, one must exploit an XSS vulnerability that triggers an “alert(1)” without any user interaction.