Posts
All the articles we've posted.
-
[CVE-2025-54571] ModSecurity Content-Type Confusion Exposes Script Source and Enables Stored XSS
For more than a decade ModSecurity has sat between Apache and the open internet. A subtle error in its error-handling path lets attackers override the Content-Type header after a parsing failure, resulting in plain-text leakage of protected scripts and reliable cross-site scripting in every version up to 2.9.11.
-
[CVE-2025-50706] From Local File Inclusion to Remote Code Execution in ThinkPHP 5.1
A flaw in ThinkPHP 5.1 lets unauthenticated attackers include arbitrary files, pivoting to full code execution on the web server. Because ThinkPHP backs many Chinese-language CMS and e-commerce platforms, the blast radius is wide.
-
[CVE-2025-54576] OAuth2-Proxy skip_auth_routes Lets Attackers Walk Straight Past the Login Screen
A design flaw in OAuth2-Proxy versions up to 7.10.0 means the skip_auth_routes option is applied to the full URL, not just the path. By adding crafty query parameters an attacker can bypass authentication completely.
-
[CVE-2024-43018] SQL Injection in Piwigo’s User Management Lets Attackers Read or Tamper with Gallery Data
The admin-side user list in Piwigo up to 13.8.0 passes two search parameters directly to MySQL. A single quote is enough to dump the photo gallery’s user table or modify it, and a public proof of concept is already on GitHub.