eval.blog

Research: #CMS, CRM and Forums

CraftCMS Zero-day Chain: XSS to SSTI triggering RCE

Public Disclosure of CVE-2021-27902 and CVE-2021-27903

July 29, 2021 ◦ 14 min ◦

• Security

Relative Path Traversal in Flarum using fake OAuth Provider

June 11, 2021 ◦ 1 min ◦

• Security

XSS in Unified Transform (A school management software)

May 18, 2021 ◦ 1 min ◦

• Security

Stored Cross Site Scripting in October CMS

April 3, 2021 ◦ 1 min ◦

• Security

Cross Site Scripting in digidocu

March 30, 2021 ◦ 1 min ◦

• Security

Internal IP Address leak in Misconfigured WordPress to bypass WAF

December 27, 2020 ◦ 3 min ◦

• Security