Vulnerability research writeups, offensive security notes, and AI engineering posts. Mostly long-form, mostly technical, no filler.
How a single unset('superuser') — with no equivalent for admin — let any user holding the users.edit permission self-assign admin over the API and take full control of Snipe-IT ≤ 8.4.0.
The same note field, left un-escaped in a single transformer: the 2021 fix for accessories was never ported to components, reopening a stored XSS in Snipe-IT ≤ 8.4.0.
How a public REST endpoint dispensing wp_rest nonces, plus a single || operator in three permission callbacks, collapsed authorization for 10,000+ WordPress sites running the Eventin plugin.
New posts on vulnerability research, AppSec patterns, and AI engineering land here as they ship. For collaborations or one-off questions, get in touch directly.