RESEARCH
REA: The Complete Guide to AI-Powered Reverse Engineering
A deep dive into REA (Reverse Engineer Anything) — the viral open-source toolkit that bridges AI coding agents with binary analysis engines like Ghidra and Hopper.
RESEARCH/WRITEUPS/FIELD NOTES
Research, writeups
& field notes.
Security research, vulnerability discoveries, exploit development and technical deep dives — plus the lessons learned along the way.
/
9Posts
8CVE Writeups
55Minutes of Reading
$ cat latest.md
FEATURED
REA: The Complete Guide to AI-Powered Reverse Engineering
A deep dive into REA (Reverse Engineer Anything) — the viral open-source toolkit that bridges AI coding agents with binary analysis engines like Ghidra and Hopper.
Read the writeup $
CVE WRITEUP
CVE-2026-82039: SQL Injection in UTMStack Asset Groups Search
A time-based blind SQL injection vulnerability in UTMStack allows authenticated users to execute arbitrary SQL queries against PostgreSQL, enabling full database compromise including credential extraction.
CVE WRITEUP
CVE-2026-77929: From Image Upload to Remote Code Execution in ClipBucket V5
A critical file upload vulnerability in ClipBucket V5 allows any registered user to upload PHP webshells disguised as images, achieving persistent remote code execution on the server.
CVE WRITEUP
CVE-2026-77928: Blind SQL Injection in ClipBucket V5 Private Message Deletion
A blind SQL injection vulnerability in ClipBucket V5 private messaging that enables full database extraction, demonstrated with complete cb_users table dump including password hashes.
CVE WRITEUP
CVE-2026-77927: Blind SQL Injection in ClipBucket V5 Photo Deletion
Exploiting a sanitizer bypass in ClipBucket V5 to achieve blind SQL injection through the photo deletion endpoint, extracting full database contents including password hashes.
CVE WRITEUP
CVE-2026-86751: Snipe-IT Arbitrary File Read and SSRF via Acceptance Note Injection
How I discovered a critical vulnerability in Snipe-IT that allows any authenticated user to read arbitrary server files and perform SSRF attacks through a simple markdown image in an acceptance note.
CVE WRITEUP
CVE-2026-80138: ClipBucket V5 Unauthenticated RCE via Web Installer Command Injection
How I discovered a critical unauthenticated remote code execution vulnerability in ClipBucket V5 web installer that allows complete server compromise with a single HTTP request.
CVE WRITEUP
CVE-2026-77915: From Zero to Admin - Unauthenticated Takeover in rConfig Core
A critical vulnerability allowing complete unauthenticated takeover of rConfig instances through a misconfigured registration route that grants Admin privileges.
CVE WRITEUP
CVE-2026-77914: rConfig Core Path Traversal to Full Application Compromise
How I discovered a critical path traversal vulnerability in rConfig Core that allows any authenticated user to read arbitrary files, including the application secrets.