Blog

Security research, vulnerability discoveries, exploit development, and technical deep dives.

Topics

CVE (3)Vulnerability Research (3)Web Security (2)rConfig (2)Laravel (2)Penetration Testing (1)RCE (1)Command Injection (1)Authentication Bypass (1)Critical (1)

CVEVulnerability ResearchWeb SecurityPenetration TestingSep 3, 2026

CVE-2026-80138: ClipBucket V5 Unauthenticated RCE via Web Installer Command Injection

How I discovered a critical unauthenticated remote code execution vulnerability in ClipBucket V5 web installer that allows complete server compromise with a single HTTP request.

Read: CVE-2026-80138: ClipBucket V5 Unauthenticated RCE ... →

CVEVulnerability ResearchAuthentication BypassrConfigAug 2, 2026

CVE-2026-77915: From Zero to Admin - Unauthenticated Takeover in rConfig Core

A CVSS 10.0 vulnerability allowing complete unauthenticated takeover of rConfig instances through a misconfigured registration route.

Read: CVE-2026-77915: From Zero to Admin - Unauthenticat... →

CVEVulnerability ResearchPath TraversalrConfigAug 1, 2026

CVE-2026-77914: rConfig Core Path Traversal to Full Application Compromise

How I discovered a critical path traversal vulnerability in rConfig Core that allows any authenticated user to read arbitrary files, including the application secrets.

Read: CVE-2026-77914: rConfig Core Path Traversal to Ful... →