Vulnerabilities
What is LDAP Injection: Mechanics, Risks and Secure Coding Practices
LDAP injection bypasses authentication by manipulating directory queries, often exploiting legacy systems that lack modern sanitisation standards.
Vulnerabilities
Vulnerabilities
Insecure Deserialization Explained: How Broken Data Becomes Code
Attackers manipulate saved data structures to execute commands on your server, bypassing standard input filters and authentication checks entirely.
Vulnerabilities
WordPress Plugin Vulnerabilities: What They Are and How They Exploit Your Site
Most plugin flaws arise from trusting user input without validation, allowing attackers to execute arbitrary code or steal data silently.
Vulnerabilities
GitHub patches npm Trusted Publishing flaw that allowed package hijacking
Researchers showed how reclaiming old GitHub repository names enabled attackers to publish malicious npm package versions without stealing credentials.
Vulnerabilities
CVE-2020-37279: easy-pdf-merge 0.2.6 Path Injection Grants Node.js Process Privileges to Attackers
The National Vulnerability Database rates CVE-2020-37279 as critical, noting that attackers can execute system commands by injecting specific characters into file paths or options.
Vulnerabilities
NVD Rates Square Squash YAML Flaw Critical 9.2 CVSS Score for Unauthenticated RCE
Unauthenticated attackers can exploit CVE-2026-109391 to execute arbitrary Ruby code in Square Squash via crafted YAML input.
Vulnerabilities
OTRS CE 6 Allows Auth Bypass via Remote-User Header in CGI Deployments
A critical flaw in OTRS Community Edition 6 lets attackers impersonate users by spoofing headers, bypassing password checks entirely.
Vulnerabilities
Remote attackers execute code on Equadio 1.1.4 via unauthenticated PHP injection CVE-2026-62087
A severe vulnerability in Equadio versions up to 1.1.4 allows remote attackers to execute arbitrary code without authentication.
Vulnerabilities
Privasys rustls v0.8.1 patches CVE-2026-108266 to stop quote relay attacks that bypass enclave attestation
A critical vulnerability in Privasys rustls allowed attackers to bypass enclave attestation via quote relay, now resolved in version 0.8.1.
Vulnerabilities
NVD Assigns 9.8 Score to ThemeREX Dwell Deserialization Weakness Enabling Object Injection
A deserialization weakness in ThemeREX Group Dwell allows object injection, rated 9.8 CVSS by the NVD for versions through 1.16.0.
Vulnerabilities
Nginx UI 2.5.0 blocks remote attackers from hijacking configs via unvalidated browser cookies
A high-severity CSRF vulnerability in Nginx UI versions 2.0.0 through 2.4.3 allows remote attackers to modify web server configurations by exploiting browser-managed authentication cookies.
Vulnerabilities
Why CVSS Scores Matter for Real-World Security Decisions
Relying solely on CVSS metrics creates blind spots that leave critical infrastructure exposed to sophisticated, low-scoring attack paths.
Vulnerabilities
Prototype Pollution Incident Response and Recovery Steps
Prototype pollution alters object behaviour silently, meaning standard input validation often fails to detect the malicious payload until it executes in memory.
Vulnerabilities
Command Injection: How Unsanitised Input Breaks Your Shell
Command injection allows attackers to execute arbitrary system commands by exploiting applications that pass user data directly to the underlying operating system shell.
Vulnerabilities
Fuzz Testing Explained: How Automated Chaos Finds Hidden Bugs
Fuzz testing exposes hidden logic errors by feeding programmes structured noise, revealing flaws that manual code review and standard unit tests consistently miss.
Vulnerabilities
SQL Injection Response: Containment, Recovery and Prevention Steps
Restoring service before verifying data integrity often re-exposes the system, turning a contained breach into a persistent backdoor that survives standard patches.
Vulnerabilities
Software Composition Analysis: Benefits, Limits and Real-World Trade-offs
Software composition analysis maps your dependencies but cannot verify how those components interact within your specific runtime environment.