Chocapikk's Cybersecurity Blog

VulnCheck's Initial Access Intelligence team details an authenticated OS command injection in the SPIP odt2spip plugin, where an uploaded document's filename is concatenated into a shell command and run, giving any low-privileged author remote code execut…

VulnCheck's Initial Access Intelligence team details an unauthenticated remote code execution in Xoscar, the actor and RPC framework behind the Xinference inference stack, where the actor pool deserializes every inbound TCP message with cloudpickle before…

VulnCheck's Initial Access Intelligence team details an unauthenticated JSON CRUD API in the JCTables component for Joomla whose escape helper trusts any value already wrapped in single quotes, turning one URL into arbitrary SQL read and write and, through

VulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it,…

Four authenticated RCEs in FileRun.

A commercial Android cheat sells itself as an AI aim assistant for Carrom Pool.

OS Command Injection in FileRun's thumbnail generation - authenticated (CVSS v4 8.7) or via public 'file request' weblinks (CVSS v4 9.2).

An unauthenticated PHP object injection in Aimy Captcha-Less Form Guard for Joomla, where a repeating-key XOR published alongside its own ciphertext turns every protected form into an unserialize() sink and, on Joomla 3.9 through 5.2.1, into remote code e…

An unauthenticated SSRF in Monsta FTP 2.14.4.

A critical unauthenticated RCE vulnerability in NVIDIA's GEN3C project.

A missing throw keyword in FOSSBilling's API router exposes the entire admin surface to unauthenticated attackers.

A Jinja2 sandbox bypass in NetBox allows low-privilege users to achieve remote code execution via the RenderTemplateMixin environment_params finalize parameter, affecting both ExportTemplate and ConfigTemplate.

Unauthenticated remote code execution in OpenCATS through unsanitized input in the installer AJAX endpoint, allowing PHP code injection into config.php.

A local code execution vulnerability in Microsoft's tensorwatch.

A critical unauthenticated RCE vulnerability in HuggingFace's LeRobot project (21.5k stars).

A critical unauthenticated RCE vulnerability in ktransformers' balance_serve backend.

Instagram's 'seen' indicator is a separate GraphQL call that any browser extension can block.

68 modules in 2.5 years.

Swap files from Vim and nano can leak usernames, hostnames, and sensitive data in git repos.

CeWL has been the default wordlist generator for 10 years.

The loginWithMailLink endpoint in Xboard and V2Board returns the magic login link in the HTTP response body, allowing unauthenticated attackers to take over any account - including admin.

Critical vulnerabilities in Windmill: unauthenticated path traversal leading to RCE, plus an authenticated SQL injection enabling full privilege escalation (operator → super admin → root RCE).

A technique for extracting PostgreSQL data through arbitrary file read vulnerabilities - without credentials, without SQL access, without knowing the schema.

How I went from knowing nothing about computers in 2020 to writing exploits.

Every shell handler fails on busybox/Alpine.

How I reverse-engineered the complete USB HID protocol of the ITE 8910 keyboard controller from a Windows DLL and .NET executable, and contributed per-key RGB support with 14 modes to OpenRGB - the first implementation for this chip on Linux.

A critical unauthenticated RCE vulnerability in sglang's ZMQ transport layer for disaggregated serving.

A critical unauthenticated RCE vulnerability in OmniGen2's reward server infrastructure.

Three chained vulnerabilities in openDCIM turn a missing authorization check into unauthenticated remote code execution on Docker deployments.

Five vulnerabilities across SPIP plugins: two SQL injections, two RCE (one unauth, one auth), and reflected XSS.

From VulnCheck advisory to working PoC in 30 minutes.

In 2023 I found CVE-2023-50917 in MajorDoMo.

How one API designed for disability access became the foundation of a $145M surveillance industry.

CVE-2026-26220: A critical unauthenticated RCE vulnerability in LightLLM's PD disaggregation system.

A critical unauthenticated RCE vulnerability in manga-image-translator.

A deep dive into how internet-wide scanners like Shodan, Censys, and nmap actually identify services.

A comprehensive security audit of AVideo revealing 10 vulnerabilities including a critical unauthenticated RCE that chains cryptographic weaknesses, predictable salt bruteforce, and an eval() vulnerability to achieve complete server compromise in under 10…

A critical vulnerability in Streama allows authenticated users to write arbitrary files through a combination of Server-Side Request Forgery (SSRF) and Path Traversal.

How I set up Giscus for ad-free blog comments using GitHub Discussions, avoiding Disqus due to ads and other concerns.

Deep dive into bind‐shell deployment, payload experiments, and a new ‘time_conf’ primitive for stealthy, persistent root access without reboot or UI lockup.

How a €5 MT02 Wi-Fi repeater let me pop a root shell with nothing more than a cheeky SSID.

Several critical vulnerabilities discovered in Xorcom CompletePBX 5.2.35, including authenticated file disclosure, remote command execution as root, file deletion, and reflected XSS.

Two missing checks inside the Open Contributions plugin let any fresh WordPress subscriber escalate to contributor and read arbitrary files — including the CTF flag — without brute-forcing a thing.

Analysis of two unauthenticated XSS vulnerabilities and silently patched issues in Vembu BDRSuite up to version 7.6.0.

WPProbe is a lightweight tool that leverages the WordPress REST API to detect installed plugins passively.

Two Stored XSS vulnerabilities discovered in MagnusBilling 7.x, including one unauthenticated, initially spotted during a CTF.

An in-depth forensic analysis of how a seemingly legitimate Proof-of-Concept (PoC) for CVE-2020-35489 turned out to be a cleverly disguised malware.

Analysis of Unauthenticated Remote Command Execution Vulnerability in Wikimedia/svgtranslate

A Detailed Analysis of Two Critical Remote Command Execution Vulnerabilities in Mocodo: Implications and Fixes