Top 10 Web Hacking Techniques

2025

The 2025 Top 10 Web Hacking Techniques: 10 Top 10 selections, 57 other nominations and 65 later archive additions, each with its researcher, summary and…

132 records · 10 in the top ten · 57 other nominations · 65 later additions · open this year in the interactive archive

The top ten

1. #1 Blind SSTI Vladislav Korchagin

   Two exploitation techniques for code injection and server-side template injection: Error-Based, which triggers errors whose messages reflect the injected code's output, and Boolean Error-Based Blind, which conditionally…

2. #2 ORM Leaking More Than You Joined For Alex Brown

   ORM Leak attacks let a user who controls a filter expression search sensitive columns such as password hashes or reset tokens character by character. This instalment bypasses Harbor's patches via an expression-parsing…

3. #3 Novel SSRF Technique Involving HTTP Redirect Loops Shubham Shah and @searchlightsec

   A blind SSRF that discloses nothing for a successful response may return the whole response for an error status. Serving a redirect loop that increments the status code through the 3xx range drives the client into that…

4. #4 Lost in Translation: Exploiting Unicode Normalization Ryan Barnett and Isabella Barnett

   How Unicode handling diverges between a front-end proxy or CDN and the back-end application. Decoding errors, overlong encodings, byte truncation, confusables, case mapping and combining diacritics all let input that…

5. #5 SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL @chudyPB and Piotr Bazydlo (@chudyPB)

   A missing cast in .NET Framework's SOAP HTTP client proxies lets a file:// or UNC URL make the proxy write its SOAP request body to disk instead of sending it. Attacker-supplied WSDL sets that URL and much of the body…

6. #6 Cross-Site ETag Length Leak arkark

   Turns the ETag header into a cross-site oracle: ETag encodes response size in hex, so crossing a hex-digit boundary changes its length by one byte, echoed back in If-None-Match, which can push a padded request past the…

7. #7 Next.js, cache, and chains: the stale elixir zhero

   The internal x-now-route-matches header makes Next.js treat a server-side-rendered request as static and return a cacheable Cache-Control, while the __nextDataReq parameter turns the response into the pageProps JSON…

8. #8 XSS-Leak: Leaking Cross-Origin Redirects Salvatore Abello and @salvatoreabello

   Chrome schedules equal-priority pending requests by port, then scheme, then host, so with the socket pool exhausted an attacker can race their own request against a victim page's cross-origin request and learn whether…

9. #9 Playing with HTTP/2 CONNECT

   In HTTP/2 the CONNECT method tunnels over a single stream instead of hijacking the whole TCP connection, so many tunnels can be multiplexed on one connection. The author builds a Go tool that abuses this against…

10. #10 Parser Differentials: When Interpretation Becomes a Vulnerability Joern Schneeweisz

    Two parsers read the same document differently: duplicate JSON keys, and YAML local versus global binary tags, make a validator and the consumer disagree. One crafted file looks benign to a scanner, ingress or auth…

Other nominations

• ASP.NET MVC View Engine Search Patterns Diyan Apostolov

  The ASP.NET MVC Razor view engine locates views with internal file-existence checks, so IIS request filtering, which only inspects request URLs, never applies. An attacker holding an arbitrary file write drops a view…

• Astro framework and standards weaponization zhero and inzo_

  Astro's Node adapter interpolates the unvalidated x-forwarded-proto and x-forwarded-port headers into the request URL, letting an attacker rewrite scheme, host, port and path. A non-special scheme payload delivers a…

• Attacks via a New OAuth flow, Authorization Code Injection, and Whether HttpOnly, PKCE, and BFF Can Help Andrey Kuznetsov

  An attacker who can run script on any page of an OAuth client's origin starts a fresh authorization code flow in a hidden frame, breaks the flow so the application never consumes the code, and replays the stolen…

• Blind trust: what is hidden behind the process of creating your PDF file? Aleksey Solovev

  An audit of seven HTML-to-PDF libraries showing that attacker-supplied HTML, CSS or SVG crosses a trust boundary inside the renderer: path traversal embeds private server files into the returned PDF, image and…

• Bypassing CSP with New Relic Custom Events Justin Gardner

  A goto parameter redirected the POST carrying a victim's login token, and the site's strict policy still permitted New Relic's beacon host. Sending the JSON body to New Relic's event API stored it as an error record…

• Client Side Path Traversal (CSPT) Bug Bounty Reports and Techniques Renwa and @RenwaX23

  Six bug bounty cases of client-side path traversal: front-end code builds an API path from a URL segment, so backslashes, double-encoded dots or router quirks send the fetch to a different endpoint. Pairing that with an…

• CRLF Injection Nested Response Splitting CSP Gadget Tang Cheuk Hei

  A CRLF injection in a response header is nested inside itself: the injected script tag points at a same-origin URL carrying a second response-splitting payload, so a strict script-src self policy is satisfied. Injecting…

• Cross-Site WebSocket Hijacking Exploitation in 2025 Laurence Tennant and @includesecurity

  Cross-Site WebSocket Hijacking lets a malicious page open an authenticated WebSocket to a server that skips the handshake Origin check, then send and read messages as the victim. Re-tested against current browsers…

• CVE-2025-1974: The IngressNightmare in Kubernetes Nir Ohfeld, Ronen Shustin, Sagi Tzadik and Hillai Ben-Sasson

  Ingress-NGINX's unauthenticated admission controller builds an NGINX config from a submitted Ingress object and injects annotation values unsanitised. Chained with the undocumented ssl_engine directive and a shared…

• CVE-2025-26788: Passkey Authentication Bypass in StrongKey FIDO Server Natalia Trojanowska-Korepta

  StrongKey FIDO Server fails to distinguish the discoverable from the non-discoverable WebAuthn authentication flow. An attacker begins preauthentication with the victim's username, replaces the returned allowed…

• Disguises Zip Past Path Traversal @phaldrzynski and Paweł Hałdrzyński

  A schizophrenic ZIP is parsed differently by two readers in the same program. When an application lists entry names with one API and extracts with another, a crafted archive hides a traversing entry from the validator…

• DOM-based Extension Clickjacking: Your Password Manager Data at Risk Marek Tóth and @MarekToth

  A single click on an attacker's page can make a password manager autofill its stored data into a hidden form: script hides the extension's injected autofill interface by setting opacity, or covers it with a transparent…

• Eclipse on Next.js: Conditioned exploitation of an intended race-condition zhero

  Next.js deduplicates in-flight requests with a promise batcher keyed only on path and revalidation flag, so two requests that both fall back to the error page share one result. Racing a request whose pageProps body is…

• Exploiting The Not So Misuse-Resistant Authenticated Encryption API of OpenSSL

  OpenSSL-backed AEAD decryption APIs in Ruby, PHP, Node.js, Rust and Erlang take the tag length from whatever tag is supplied, so code that never checks it accepts a one-byte tag, brute-forceable in 256 tries. An…

• Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql stypr

  The mysqljs/mysql escape function encodes values differently per JavaScript type, and an Object becomes backtick-quoted identifiers rather than a quoted string. Passing a parameter as an object through Express turns a…

• Fontleak: exfiltrating text using CSS and Ligatures Dragos Albastroiu

  An attacker who can inject CSS loads a custom font whose ligature rules collapse a known prefix plus the next character into a single glyph of a distinct width, so a container query on a sibling element measures that…

• Forcing Quirks Mode with PHP Warnings + CSS Exfiltration without Network Requests arkark

  Overflowing the PHP input-variable limit emits a warning before the doctype, forcing quirks mode, where the same-origin MIME check is relaxed so a 404 page echoing the URL loads as a stylesheet under a self-only policy…

• Funky chunks – addendum: a few more dirty tricks Jeppe Bonde Weikop

  Extends the chunked-body smuggling family. If one parser blindly skips two bytes as the chunk-body terminator while the other accepts a bare newline, a byte of the next chunk size is consumed and the two disagree on its…

• Funky chunks: abusing ambiguous chunk line terminators for request smuggling Jeppe Bonde Weikop

  HTTP implementations disagree over what ends a line in a chunked body: some read a bare newline inside a chunk extension as a terminator, others swallow it, and some accept any two bytes after an oversized chunk body…

• Fuzzing WebSockets for Server-Side Vulnerabilities

  Extends a Burp scanner to WebSockets by opening a fresh connection per payload, optionally sending prerequisite handshake messages, and capturing every message that arrives in a configurable window. Anomalies are judged…

• Google Cloud Account Takeover via URL Parsing Confusion Mohamed Benchikh

  Google's OAuth backend and Chrome disagree about URLs carrying two at-signs and IPv6 loopback literals, so a redirect target passes Google's loopback allow-list while the browser navigates to the attacker's host. An…

• Hacking Gemini: A Multi-Layered Approach Valentino Massaro

  Gemini renders model output through several layers, and its linkifier does not count an exclamation mark as part of a hostname, so injected text can flip a trusted link into a Markdown image. Chained with indirect…

• How I Accessed 1,800 Company Livestreams and Uncovered a New Web Exploit Class: RRE Farzan Karimi

  Recursive Request Exploits trace a chain of dependent API calls backwards from a sensitive value such as a stream identifier to the first request that introduces it, then abuse the earliest hop that enforces no…

• how to hack discord, vercel and more with one easy trick eva.ac

  A documentation platform rendered customer pages server side, so an expression in a docs page ran code on its server, exposing environment secrets and a cache shared by every customer. A separate static-asset route also…

• How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs Bruno Halltari and Caue Obici

  Two authentication flaws found auditing exchanges and wallets. Allow-listing localhost as an OAuth origin lets a malicious mobile app run a local web server and complete sign-in silently to capture the token…

• HTTP/1.1 must die: the desync endgame James Kettle

  New classes of HTTP desync against upstream HTTP/1.1: detecting parser discrepancies with masked headers, making zero-length desyncs exploitable through early-response gadgets and a double-desync that converts them, and…

• Impossible XXE in PHP Aleksandr Zhurnakov

  Exploits XXE in PHP code that looks safe: external entity loading off, network access disabled, and DOCTYPE nodes rejected after parsing. Parameter entities expanded while parsing, a system identifier on the DOCTYPE…

• Inline Style Exfiltration: leaking data with chained CSS conditionals Gareth Heyes

  CSS conditional functions inside a style attribute can test an element's own attribute value, and chaining them nested picks a different background image URL per candidate value. An attacker who controls only an inline…

• MadeYouReset Technical Details - How (and Why) It Works? Gal Bar Nahum

  MadeYouReset makes an HTTP/2 server reset a stream itself, using primitives such as a zero-increment window update or a frame sent after the client closed the stream. The reset frees the concurrency slot at once while…

• Make Self-XSS Great Again Slonser

  Credentialless iframes share an origin with ordinary iframes, so one page can hold a frame logged into the attacker's account and another in the victim's session and script across them. With login CSRF or clickjacking…

• Make XXE Attacks Brilliant Again !!! killer

  A Java XXE that swallows every error can still be exploited out of band on Windows: FTP exfiltration is limited to a single line from JDK 8u131 onward and HTTP URLs reject newlines, but file and netdoc URLs aimed at a…

• Nonce CSP bypass using Disk Cache Jorian Woltjer

  Turns an HTML injection into XSS under a nonce-based policy. CSS injection leaks the nonce from the meta policy tag, then forcing a fall back to disk cache replays the page with its old nonce while login CSRF and cache…

• Novel SQL Injection Technique in PDO Prepared Statements Adam Kues and @searchlightsec

  PDO emulates prepared statements by default and parses the SQL with its own scanner. A null byte makes that scanner abandon a backtick-quoted identifier, so an attacker's question mark inside a column name becomes a…

• Opossum Attack Robert Merget, Nurullah Erinola, Marcel Maehren, Lukas Knittel, Sven Hebrok, Marcus Brinkmann, Juraj Somorovsky and Jörg Schwenk

  Cross-protocol desynchronisation against services that offer both implicit TLS on a dedicated port and opportunistic TLS upgrade. A man-in-the-middle splices the client's TLS connection onto its own upgraded plaintext…

• Permission Hijacking at Scale Alberto Fernandez-de-Retana

  Permissions delegated to an iframe cannot be revoked by the host page, prompts name the top-level origin rather than the frame, and delegated grants never re-prompt. Compromising one widely embedded support-chat vendor…

• PermissionJacking: How a Subtle Bug in Safari Could Lead to Camera Hijacking RenwaX23

  Safari on macOS leaves camera, microphone and location prompts clickable while the window is unfocused, so one click reaches Allow. Two clickjacking methods hide the prompt under a pop-up: one flickers the pop-up size…

• Prepared Statements? Prepared to Be Vulnerable. Balazs Bucsay

  The Node.js mysql and mysql2 drivers convert JavaScript objects and arrays into SQL fragments by default, so submitting a JSON object where a string is expected turns a correctly parameterised prepared statement into…

• Prompt Injection Inside GitHub Actions: The New Frontier of Supply Chain Attacks Rein Daelman

  CI workflows paste untrusted issue, pull-request and commit text straight into prompts for AI agents that hold write-scoped tokens and shell tools. A crafted issue body is read as instructions, so the agent uses its own…

• Python Dirty Arbitrary File Write to RCE via Writing Shared Object Files Or Overwriting Bytecode Files siunam

  Two ways to turn a restricted arbitrary file write into code execution in Python web applications. Overwriting a cached bytecode file works when the magic number, source timestamp and size are preserved or brute-forced…

• Racing and Fuzzing HTTP/3: Open-sourcing QuicDraw(H3) Maor Abutbul

  Adapts the single-packet race-condition attack to HTTP/3: because QUIC forbids IP fragmentation, every request is queued minus its final byte and all the withheld last bytes are released together in one packet, so the…

• React2Shell: JavaScript's Long-Awaited Deserialization Flight-mare (CVE-2025-55182) Lachlan Davidson

  The finder's page for React2Shell, an unauthenticated remote code execution flaw in server-side React reached through Server Component endpoints and tracked separately for Next.js because Next.js vendors React. It gives…

• ReDisclosure: New technique for exploiting Full-Text Search in MySQL (myBB case study) Exploit Azerbaijan

  MySQL boolean-mode full-text search operators form a matching language that escaping, prepared statements and scanner rules do not treat as injection. Smuggling them into a full-text search turns the…

• Ruby Array Pack Bleed Luke Jahnke

  A signed and unsigned mismatch in the repeat-count parsing of Ruby's Array pack makes a huge count negative, so the back-up-a-byte directive grows the packed string instead of shrinking it. The result discloses heap…

• SharePoint ToolShell – One Request PreAuth RCE chain CVE-2025-53770 @_l0gg and khoadha

  A one-request pre-auth remote code execution chain in SharePoint: a Referer of the SignOut page skips the anonymous-access check, and ToolPane.aspx parses attacker-supplied control markup before the form-digest check. A…

• Stopping Redirects Jorian Woltjer

  Ways to cancel or pause a browser redirect: unredirectable protocols, dangling-markup URL blocking, overlong URLs and cookie bombing that force error pages, WAF triggering, the navigation rate limit, and sandboxing a…

• SVG Filters - Clickjacking 2.0 rebane2001

  SVG filters still apply to cross-origin iframes, and tiling, blending and compositing primitives can crop single pixels of the framed page and combine them into logic gates. An overlay can then read the framed…

• Temenos OFS Field Injection: Revealing a Hidden Financial Attack Vector Omar Elshopky (3l5h0pky)

  An instant payment API concatenated user input straight into Temenos T24 OFS command strings, so a comma lets an attacker append extra fields to the funds-transfer request. Overriding the debit account number takes the…

• The Fragile Lock: Novel Bypasses For SAML Authentication Zakhar Fedotkin

  Parser inconsistencies between REXML, Nokogiri and libxml2 let an attacker forge SAML responses: attribute pollution, namespace confusion via the reserved xml prefix, and a canonicalisation failure that makes the digest…

• The minefield between syntaxes: exploiting syntax confusion Alex Brumen

  Parsers in one stack accept different syntaxes for the same value: Python and Perl named unicode escapes, Content-Disposition filename versus filename*, file URIs carrying a host, and PHP parse_url ports with leading…

• The Quiet Side Channel... Smuggling with CL.0 for C2 d3d (M. B. Johnson)

  Shows how a CL.0 request-smuggling desync against CDN-fronted sites can poison the shared cache so a chosen string is stored in a 3xx Location redirect header. Reading and writing encoded data through that poisoned…

• The Single-Packet Shovel: Digging for Desync-Powered Request Tunnelling Thomas Stacey and @AssuredAB

  HTTP/2 to HTTP/1.1 downgrade request tunnelling is widely dismissed as a smuggling false positive; sending a deliberately invalid tunnelled request exposes it, and firing a group of requests as a single packet turns a…

• The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Appliance Mehmet Ince and @mdisec

  Chains six weaknesses in the LogPoint SIEM appliance into unauthenticated remote code execution: proxy path routing that exposes internal endpoints, a hard-coded token signing secret, leaked credentials for a hidden…

• Trailing Danger: exploring HTTP Trailer parsing discrepancies Sebastiano Sartor, Sebastiano Sartor - sebsrt and @s3bsrt

  Audits around 70 HTTP implementations for how they handle chunked trailer fields and shows that merging trailers into the header section, or validating them loosely, lets an attacker inject headers the front-end never…

• Under the Beamer kevin_mizu

  DOM clobbering gadget in a widget library. Because named items of an HTML collection are not writable, injected elements sharing an identifier stop the library assigning its own escaping function; a second gadget…

• Unexpected security footguns in Go's parsers The Trail of Bits Blog

  Go's JSON, XML and YAML parsers are surprisingly lenient: a dash struct tag with omitempty leaves the field settable, JSON matching is case-insensitive and keeps the last duplicate key, and the XML parser accepts…

• Vega CVE-2025-59840 - Unusual XSS Technique toString gadget chains Nick Copi

  Vega's sandboxed expression language forbids arbitrary function calls, but an object whose toString is set to a library method has that method invoked on coercion. Because the method calls one of its own properties with…

• VESTA Admin Takeover by exploiting bash $RANDOM limitations Adrian Tiron and @adrian__t

  Bash seeds its random variable by XORing microseconds and the process id into the timestamp without any bit shift, so only the low 20 bits vary and the seed lies within about a 12-day window of install time. Vesta…

Added after the original list

• 8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur Benjamin Harris, Aliz Hammond and Pinaki Mondal

  About 150 abandoned Amazon S3 buckets, still referenced by software, documentation and deployment pipelines, were re-registered and logged over 8 million requests in two months from government, military and Fortune 500…

• All I Want for Christmas is Your Secrets: LangGrinch hits LangChain Core (CVE-2025-68664) Yarden Porat

  Explains how LangChain serialization failed to escape user dictionaries containing its reserved `lc` marker. Prompt-controlled response fields can survive a trusted serialization round trip and be deserialized as…

• Automatic Insecurity: Exploring Email Auto-configuration in the Wild Shushang Wen, Yiming Zhang, Yuxiang Shen, Bingyu Li, Haixin Duan and Jingqiang Lin

  First systematic study of email auto-configuration, where a client fetches server settings from the domain or DNS instead of the user typing them. Ten attack scenarios covering seventeen defects let an attacker steer a…

• Be Aware of What You Let Pass: Demystifying URL-based Authentication Bypass Vulnerability in Java Web Applications Qiyi Zhang, Fengyu Liu, Zihan Lin and Yuan Zhang

  Studies authentication bypasses caused by disagreement between Java URL routing and access checks. UABScan extracts framework routing features, slices URL-dependent code, and matches risky checks against sanitization…

• Bullseye: Detecting Prototype Pollution in NPM Packages with Proof of Concept Exploits Tariq Houis
• By Executive Order, We Are Banning Blacklists: Domain-Level RCE in Veeam Backup and Replication (CVE-2025-23120) Piotr Bazydlo and Sina Kheirkhah

  Traces a Veeam .NET Remoting chain through an allowed outer object and denylisted inner deserialization. Product-specific DataSet subclasses inherit dangerous parent behavior while escaping class-name checks; the source…

• Bypass for CVE-2024-9956 in Safari on iOS Dennis Kniep

  A Shortcuts deep link can dispatch a FIDO URI through its error or cancellation callback after Safari blocks direct navigation to that scheme. The article explains the callback gadget and hybrid authentication flow…

• Bypassing Authentication Like It's The '90s: Pre-Auth RCE Chain(s) in Kentico Xperience CMS Piotr Bazydlo

  Follows SOAP UsernameToken handling through a custom password callback and attacker-selected authentication modes. An empty-secret digest and a later omitted-password variant bypass Kentico staging authentication under…

• Cache Me If You Can: Sitecore Experience Platform Cache Poisoning to RCE Piotr Bazydlo

  Uses restricted Sitecore reflection to invoke a control’s AddToCache method and poison a server-side rendering cache. Configuration analysis and metadata/count queries recover usable cache keys; a privileged reader can…

• Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting Leon Trampert, Daniel Weber, Lukas Gerlach, Christian Rossow and Michael Schwarz

  Script-less fingerprinting built from modern CSS. Container queries, arithmetic functions and complex selectors leak application, operating system and hardware details even where JavaScript is disabled, separating 97.95…

• Cloudflare Image Proxy as a CSPT Gadget: A Cross-Origin CSPT Exploit Amirmohammad Safari

  A client-side path traversal is normally confined to the origin hosting the vulnerable fetch. Chaining it to a gadget that answers with a 307 or 308 redirect, such as an image transformation endpoint, preserves method…

• Cloudflare Zero-day: Accessing Any Host Globally k_firsov

  Shows that Cloudflare's special ACME challenge path could bypass customer WAF policy and reach otherwise protected origins. The researchers demonstrate constrained access to arbitrary origin hosts through…

• Consent & Compromise: Abusing Entra OAuth for Fun and Access to Internal Microsoft Applications Vaisha Bernard and @eyesecurity_

  Analyzes Microsoft Entra OAuth consent and first-party application behavior to obtain access to internal Microsoft services. The research combines delegated permissions, token exchanges, and trust in Microsoft-owned…

• Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients @jfrog

  Explains CVE-2025-6514 in mcp-remote, where an untrusted authorization endpoint can supply crafted metadata that reaches an operating-system command invocation. The write-up follows the OAuth discovery path to command…

• Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange Pinji Chen, Jianjun Chen, Mingming Zhang, Qi Wang, Yiming Zhang, Mingwei Xu and Haixin Duan

  HTTP/2 server push and Signed HTTP Exchange authorise content by the certificate's subject alternative names rather than by the URI origin, so where a certificate is shared an off-path attacker can push or sign…

• CSS Data Exfiltration to Steal OAuth Token Amirmohammad Safari and Yashar Shahinzadeh

  Combines an OAuth redirect with CSS injection on a page where an advertising script reflects the URL token into a DOM attribute. Imported styles test that attribute and signal matches through background requests; the…

• CVE-2025-51471: Ollama authentication token theft via unvalidated WWW-Authenticate realm Mohammed Benhelli and Patrick Ventuzelo

  Advisory for CVE-2025-51471 describing credential theft from Ollama through an unvalidated WWW-Authenticate realm. A malicious endpoint can redirect the client's authentication flow so that a registry token is disclosed…

• Discourse Backup Disclosure: A Rails send_file Quirk Harsh Jaiswal and Rahul Maini

  Explains how client-influenced file-delivery headers crossed the boundary between Rails/Rack and trusted Nginx routing, exposing Discourse backup files. This March 2025 analysis expands a December 2024 disclosure and…

• Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection Soheil Khodayari, Kai Glauber and Giancarlo Pellegrino

  Re-assessment of open redirects, focused on client-side JavaScript redirections. A static and dynamic pipeline mined 184 vulnerability indicators and found 20,800 open redirects across 623 of the top 10,000 sites plus…

• EvoCrawl: Exploring Web Application Code and State using Evolutionary Search Xiangyu Guo, Akshay Kawlay, Eric Liu and David Lie

  EvoCrawl crawls web applications using evolutionary search over sequences of interactions, so it satisfies field and format constraints and reaches server states earlier scanners miss: 59 percent more code coverage and…

• Finding SSRFs in Azure DevOps Torjus Bryne Retterstøl and @Torjus Bryne Retterstøl

  Maps several Azure DevOps server-side URL-fetching features and shows how weak validation can be turned into SSRF against internal services. The research develops practical bypasses and demonstrates impact across hosted…

• GitHub MCP Exploited: Accessing private repositories via MCP @invariantlabsai

  Shows how prompt injection in a public GitHub issue can steer an MCP-enabled coding agent into reading data from a private repository and disclosing it in a public pull request. The chain crosses trust boundaries…

• Gotchas in Email Parsing - Lessons From Jakarta Mail Jia Hao Poh

  Maps Jakarta Mail, Spring mail wrappers and Hibernate validation to concrete email-parsing decisions. Constructor and setter examples contrast parsed input with direct assignment, encoded personal names and group…

• How We Exploited CodeRabbit: From a Simple PR to RCE and Write Access on 1M Repositories Nils Amiet

  Shows how a pull request could alter CodeRabbit's RuboCop configuration so the review service loaded attacker-controlled Ruby code. The resulting execution exposed service credentials and enabled write access to…

• How we got persistent XSS on every AEM cloud site, thrice Adam Kues

  Describes three routes to persistent cross-site scripting across Adobe Experience Manager Cloud deployments. The chains abuse shared authoring and delivery behavior, stored content, and insufficient sanitization to make…

• HPACK Bombing Apache Stefan Eissing

  Explains how HPACK expansion, repeated-header merging and APR allocation lifetime exhaust Apache HTTP/2 memory despite nominal request limits. Long names with empty values evade accounting while temporary strings remain…

• IDEsaster: A Novel Vulnerability Class in AI IDEs Ari "MaccariTA" Marzouk

  Shows how prompt-injected coding agents can use ordinary file tools to activate inherited IDE features rather than vulnerable agent tools. Remote JSON schemas exfiltrate data, executable-path settings trigger commands…

• In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web Jan Drescher, Sepehr Mirzaei, Soheil Khodayari, David Klein, Thomas Barber, Martin Johns and Giancarlo Pellegrino

  Combines taint tracking and static analysis to find DOM reads that influence script execution, requests, links, and other sensitive operations. Pairs verified gadgets with markup injection points and studies parser…

• Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain Mehmet Ince

  Chains a PostHog webhook validation gap into persistent SSRF against its internal ClickHouse HTTP API. Incorrect PostgreSQL escaping in a ClickHouse table function permits SQL injection, and PostHog's default database…

• Leaking the email of any YouTube user for $10,000 Arvin Shivram & Nathan (schizo.org)

  Chains YouTube's blocked-user identifier with a Google account-recovery flow to reveal the email address behind a channel. The write-up explains the identifier conversion, rate and cost constraints, and a practical…

• MCP Security Notification: Tool Poisoning Attacks @invariantlabsai

  Introduces tool-poisoning attacks against Model Context Protocol clients, where malicious descriptions contain instructions visible to the model but hidden from the user. The demonstrations redirect tool behavior…

• MerCuriuzz: Identifying Logical Vulnerabilities in QUIC Implementations Kaihua Wang

  Publishes the MerCuriuzz artifact for testing logical failures in QUIC implementations. The method combines segmented interaction mutation, semantic differences and resource-use oracles to expose CPU, memory and…

• Millions of Accounts Vulnerable due to Google’s OAuth Flaw Dylan Ayrey

  Shows that Google OAuth identifiers tied to defunct company domains can become valid again when an attacker re-registers the domain and recreates employee accounts. Applications relying only on immutable Google identity…

• More Than DoS: Progress Telerik UI for ASP.NET AJAX Unsafe Reflection (CVE-2025-3600) Piotr Bazydlo

  Investigates request-controlled type resolution and no-argument constructors in Telerik UI. The article separates denial-of-service effects from conditional execution paths, then traces a Sitecore chain that initializes…

• My ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP Parsers Yufan You, Jianjun Chen, Qi Wang and Haixin Duan

  A differential fuzzer compared 50 ZIP parsers across 19 programming languages and found 14 classes of parsing ambiguity, 10 of them new. One crafted archive is read differently by two programs, letting an attacker slip…

• Network-Level Prompt and Trait Leakage in Local Research Agents Hyejun Jeong, Mohammadreza Teymoorianfard, Abhinav Kumar, Amir Houmansadr and Eugene Bagdasarian
• New Method to Leverage Unsafe Reflection and Deserialisation to RCE on Rails Alex Brown

  Unsafe Ruby reflection or Marshal deserialisation in a Rails app becomes remote code execution by constructing a SQLite3 database object whose extensions option loads an attacker-supplied shared library. The file is…

• Next.js and the corrupt middleware: the authorizing artifact zhero and Yasser Allam

  Finds that a crafted internal middleware header can make vulnerable Next.js deployments skip middleware execution. Because applications commonly implement authorization in middleware, direct requests bearing the header…

• NodeMedic-FINE: Automatic Detection and Exploit Synthesis for Node.js Vulnerabilities Darion Cassel, Nuno Sabino, Min-Chien Hsu, Ruben Martins and Limin Jia

  NodeMedic-FINE pairs a type and object-structure aware fuzzer with dynamic taint tracking over npm packages, then uses the taint information to synthesise proof-of-concept exploits for arbitrary code execution and…

• One Email, Many Faces: A Deep Dive into Identity Confusion in Email Aliases Mengying Wu, Geng Hong, Jiatao Chen, Baojun Liu, Mingxuan Liu and Min Yang
• One Token to rule them all — obtaining Global Admin in every Entra ID tenant via Actor tokens

  Reverse-engineers Microsoft Entra actor tokens and shows how an improperly constrained token path could yield Global Administrator access in arbitrary tenants. The article traces the token exchange, validation…

• PANGOLIN: Fuzzing Multilingual IoT Firmware with LLM-Driven Code Analysis Zhipeng Jia, Xiaokang Yin, Shuitao Gan, Chao Zhang, Hangtian Liu, Jiangan Ji, Enzhou Song, Ruijie Cai, Jinglei Tan and Shengli Liu

  Original December 2025 artifact for multilingual IoT firmware fuzzing. It combines handler and parameter recovery across languages, LLM-assisted constraint extraction, structured input generation and response feedback…

• Perplexity Comet UXSS s1r1us and sudi

  Studies Comet’s trust in a vendor origin: an XSS there could reach privileged browser-extension capabilities and agent task interfaces across website origins. The account separates those direct browser-authority paths…

• Phishing Attacks against Password Manager Browser Extensions Claudio Anliker, Daniele Lain and Srdjan Capkun

  Password manager extension popups are painted over the page viewport and look no different from page content, so a site the attacker controls can render a convincing replica of a locked password manager and capture the…

• Posthammer: Pervasive Browser-based Rowhammer Attacks with Postponed Refresh Commands Finn de Ridder, Patrick Jattke and Kaveh Razavi

  A Rowhammer attack written in JavaScript that alternates bursts of intense hammering with long idle windows, so the memory controller postpones and batches the refresh commands that would otherwise trigger in-memory…

• Puny-Code, 0-Click Account Takeover Yashar Shahinzadeh and Amirmohammad Safari

  Explains how database collation can equate distinct email spellings while message delivery preserves their difference. Reset and OAuth examples map the wrong identity to a victim account; SQL probes, a safe WordPress…

• Pwning OpenAI Atlas Through Exposed Browser Internals s1r1us and sudi

  Analyzes exposed browser internals in OpenAI Atlas, combining vendor-origin XSS and login CSRF with privileged Mojo interfaces. Demonstrated tab-URL disclosure can expose authorization codes in susceptible flows; the…

• RaceDB: Detecting Request Race Vulnerabilities in Database-Backed Web Applications An Chen, Yonghwi Kwon and Kyu Hyung Lee

  RaceDB finds request race conditions in PHP database-backed applications by tracking data dependencies through the application code as well as the SQL, building a race graph, then replaying candidate request pairs both…

• RebirthDay Attack: Reviving DNS Cache Poisoning with the Birthday Paradox Xiang Li, Mingming Zhang, Zuyao Xu, Fasheng Miao, Yuqi Qiu, Baojun Liu, Jia Zhang, Xiaofeng Zheng, Haixin Duan, Zheli Liu, Yunhai Zhang and Dunqiu Fan

  Studies how distinct EDNS Client Subnet values prevent DNS query aggregation while replies omitting that option create additional spoofed-response matches. Controlled resolver experiments and deployment measurements…

• SAML roulette: the hacker always wins Gareth Heyes and Zakhar Fedotkin

  Ruby-SAML validates with one XML parser and reads attributes with another, so a round-trip mutation in a system identifier, and namespace confusion built from duplicate declarations the first parser wrongly permits…

• Stealing HttpOnly cookies with the cookie sandwich technique Zakhar Fedotkin

  Introduces the cookie sandwich technique for exposing HttpOnly cookie values through discrepancies in how servers parse legacy quoted cookies. An attacker-controlled cookie can surround a protected cookie so an…

• Stealing oAuth Token via Referrer Policy Override Omid Rezaei

  Turns a limited image injection into OAuth-code leakage by controlling the image response. A Link preload header specifies unsafe-url referrer policy, causing the documented Chrome behavior to disclose the embedding…

• STEK Sharing is Not Caring: Bypassing TLS Authentication in Web Servers using Session Tickets Sven Hebrok, Tim Leonhard Storm, Felix Matthias Cramer, Maximilian Radoy and Juraj Somorovsky

  Web servers that share one TLS session ticket encryption key across their virtual hosts let a ticket issued by one host be resumed against another, confusing which host and which client a session belongs to. That…

• Styled to Steal: The Overlooked Attack Surface in Email Clients Leon Trampert, Daniel Weber, Christian Rossow and Michael Schwarz

  Injecting standard CSS into an encrypted email lets an attacker read its decrypted text: attacker-crafted font ligatures give the plaintext a content-dependent width, container queries measure that width, and each width…

• SupaPwn: Hacking Our Way into Lovable's Office and Helping Secure Supabase s1r1us, rootxharsh, zayne and LiveOverflow

  Investigates Supabase database privilege boundaries, showing how event-trigger callbacks and missing ownership checks interacted with temporary elevated roles. The complete chain applied to deprecated infrastructure…

• The Power to Never Be Wrong: Evasions and Anachronistic Attacks Against Web Archives Robin Kirchner, Chris Tsoukaladelis, Martin Johns and Nick Nikiforakis

  Studies eight web archives using instrumented pages and crawler metadata. It shows how CSP or script stripping and server-side cloaking distort captured content, while future archive references and live-web escapes let…

• Tracing JavaScript Value Origins with Breakpoint-Driven Heap Search (BDHS) and Live Object Search Francesco Cavallarin

  Presents Breakpoint-Driven Heap Search, which takes repeated Chrome DevTools Protocol heap snapshots at user-land step-out boundaries and finds where a target value or structure first appears. Wirebrowser combines…

• TranSPArent: Taint-style Vulnerability Detection in Generic Single Page Applications through Automated Framework Abstraction Senapati Diwangkara and Yinzhi Cao
• Turning List-Unsubscribe into an SSRF/XSS Gadget Lauritz Holtmann

  Treats the SMTP List-Unsubscribe header as attacker-controlled URL input in webmail applications. A JavaScript URI becomes stored XSS in Horde, while Nextcloud Mail's server-side unsubscribe request becomes blind SSRF…

• Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau and Julien Lecomte

  Integration platforms such as workflow automation tools and smart homes link user accounts to third-party apps over OAuth without telling the apps apart, so authorization granted to one app reaches another. A hostile…

• Vault Raider: Stealthy UI-based Attacks Against Password Managers in Desktop Environments Andrea Infantino, Mir Masood Ali, Kostas Solomos and Jason Polakis

  Compares password-manager autofill and credential-copy interfaces across desktop environments. Original code illustrates how alternate UI paths can weaken application-identity checks, with explicit unlocked-vault and…

• When WebSockets Lead to RCE in CurseForge Elliott

  A malicious website discovers CurseForge's localhost WebSocket and controls it because the launcher does not validate Origin. Creating a modpack and supplying JVM out-of-memory handler arguments converts the…

• Windsurf: DNS rebinding against a local AI coding service s1r1us
• Write Path Traversal to a RCE Art Department Diyan Apostolov

  Builds a methodology for turning arbitrary file-write or write-path-traversal flaws into code execution. It catalogs execution-sensitive destinations, application configuration files, scheduled tasks, hooks, and other…

• WSO2 #2: The many ways to bypass authentication in WSO2 products crnković

  Documents multiple authentication-bypass patterns across WSO2 products, including path-normalization differences and endpoint-routing mistakes. Crafted request paths reach protected administrative functionality without…