S.00 / ARCHIVE
Stories.
All historical notes and writeups.
CVE-2026-34747 - Payload CMS SQL Injection
An SQL injection in Payload CMS exposes the underlying database through a single crafted request.
CVE-2026-28501 - AVideo Unauthenticated SQL Injection
A critical SQL injection in AVideo allows unauthenticated remote attackers to exfiltrate the entire database by smuggling a single JSON field past the application's global input sanitizer.
Ledger Wallet Impersonation Analysis
Diving into a fake Ledger Live macOS app that tricks users into entering their recovery phrase and silently sends it to an attacker.
macOS Stealer Campaign
Diving into a suspicious Cloudflare-like page targeting macOS users and attempting to trick visitors into executing malicious code, similar to the ClickFix campaign.