CVE-2026-47752 – Server-Side Template Injection in tugtainer Leads to Root Remote Code Execution

A critical Server-Side Template Injection (SSTI) vulnerability in tugtainer that allows authenticated attackers to achieve root Remote Code Execution (RCE).

Jul 31, 2026 CVE-Analysis

CVE-2023-24329 – URL Blackslisting Bypass in Python's urllib.parse

A vulnerability in Python's urllib.parse module that allows attackers to bypass URL blocklists simply by adding leading whitespace before a URL.

Jul 27, 2026 CVE-Analysis

CrewCTF 2025 – Reflective (Web)

Writeup for Reflective (Web) challenge from CrewCTF 2025 where I discussed two unintended solutions.

Sep 22, 2025 CTF

SekaiCTF 2025 – My Flask App (Web)

Writeup for My Flask App (Web) challenge from SekaiCTF 2025. 1st Place – SekaiCTF 2025 Writeup Contest.

Aug 18, 2025 CTF

CVE-2025-53770 – Microsoft SharePoint RCE

A zero‑day remote code execution vulnerability in Microsoft SharePoint (on‑premises).

Jul 25, 2025 CVE-Analysis

CVE‑2025‑29927 – Next.js Middleware Authorization Bypass

CVE‑2025‑29927 is a critical vulnerability (CVSS 9.1) in Next.js that allows attackers to bypass middleware‑based security checks.

Jul 23, 2025 CVE-Analysis