CryptoCat
@cryptocat.me
Security Researcher @rapid7.com 😈 Hacking Content @ https://yt.cryptocat.me 💜
Write-up for a (out of scope 😕) stored XSS [A]I found in the Quiz and Survey Master plugin 😼 cryptocat.me/blog/researc...
Quiz and Survey Master Stored XSS via question_title | CVE-2026-11780 | CryptoCat's Blog
Root cause analysis of CVE-2026-11780 in Quiz and Survey Master, where the REST question-create endpoint stored an unsanitised question_title that the Question Bank rendered as raw HTML for administra...
cryptocat.me
Bonus episode of the @rapid7.com podcast this week! @stephenfewer.bsky.social joins @fulmetalpackets.bsky.social and myself to talk about all things #Pwn2Own 😎 I also show off a P2O inspired CTF challenge I made for @hackinghub.bsky.social, you can still play today! youtu.be/Dnx9yDwXCiE
Hacktics & Telemetry, E12: Pwn2Own, AI in Exploit Chains & Brother Printer Hacks (ft. Stephen Fewer)
YouTube video by Rapid7
youtu.be
Write-up for a stored XSS [A]I found in the UsersWP plugin 👇 cryptocat.me/blog/researc...
UsersWP Stored XSS via Badge Variable Substitution | CVE-2026-18501 | CryptoCat's Blog
Root cause analysis of CVE-2026-18501 in UsersWP, where the badge renderer decodes an entity-encoded Subscriber profile value and outputs it as unescaped HTML.
cryptocat.me
What started with a simple question on Discord, ended in *reviving an old XS-Leak technique* for probing status codes in background requests! Unravel the mystery with me in the latest @ctbbpodcast.bsky.social blog post: lab.ctbb.show/research/sol...
Last week I posted about the KindaRails2Shell (CVE-2026-66066) @metasploit-r7.bsky.social module I put together. Here's a @rapid7.com technical analysis to go with it! 💜 www.rapid7.com/blog/post/ra...
Rapid7
Rapid7 analyzes KindaRails2Shell (CVE-2026-66066), a Ruby on Rails Active Storage vulnerability that can allow attackers to abuse libvips and crafted MAT/HDF5 uploads to read arbitrary files from the ...
rapid7.com
Another Essential Addons bug.. with a much smaller bounty! 😁 A Contributor could poison the site-wide Reading Progress bar with JavaScript. Once their post was published, moving over the bar on an unrelated page ran the payload in the visitor's session. cryptocat.me/blog/researc...
Essential Addons for Elementor Global Reading Progress Stored XSS | CVE-2026-15156 | CryptoCat's Blog
Root cause analysis of CVE-2026-15156 in Essential Addons for Elementor Lite, where a Contributor-controlled Reading Progress colour is stored globally and rendered without escaping, causing stored XS...
cryptocat.me
It might not be RCE in core, but I was awarded an $859 bounty for this bug 🙏 When entering a victim email into a password reset field, you can inject a newline and [silenty] BCC the attacker on the password reset email 😼 cryptocat.me/blog/researc...
Essential Addons for Elementor Email Header Injection to Admin Account Takeover | CVE-2026-15155 | CryptoCat's Blog
Root cause analysis of CVE-2026-15155 in Essential Addons for Elementor Lite, where a Contributor-controlled Login/Register widget setting injects a Bcc header into the administrator password reset em...
cryptocat.me
Another day, another WP plugin writeup 🫡 cryptocat.me/blog/researc...
Contact Form Entries Unauthenticated Arbitrary File Copy to File Read | CVE-2026-9145 | CryptoCat's Blog
Root cause analysis of CVE-2026-9145 in Contact Form Entries, where the 1.5.1 rewrite of create_entry_el() fed an Elementor upload field's raw POST value into PHP copy(), letting an unauthenticated at...
cryptocat.me
It took a while, but the third (and final) vulnerability I reported in ProfileGrid has been published 💥 cryptocat.me/blog/researc...
ProfileGrid Stored XSS to Admin Account Takeover via Private Messages | CVE-2026-4610 | CryptoCat's Blog
Root cause analysis of CVE-2026-4610 in ProfileGrid, where any Subscriber can store an invisible onclick overlay in another user's private message inbox and turn an admin's next click into a new admin...
cryptocat.me
I found a stored XSS in the slideshow feature of Hedgedoc. It was the preview release, so no CVE (or patch), but here's the writeup anyway! 🦔 cryptocat.me/blog/researc...
HedgeDoc 2 Stored XSS via Slideshow Reveal Background Iframe | CryptoCat's Blog
Root cause analysis of a stored XSS in HedgeDoc 2's slideshow renderer, where a Reveal data-background-iframe attribute carrying a javascript: URL survives DOMPurify and is later loaded as an iframe s...
cryptocat.me
Here's the writeup for CVE-2026-53943, a cache poisoning -> XSS vuln I found in Ghost CMS 👻 cryptocat.me/blog/researc...
Ghost CMS Unauthenticated Cache-Poisoning XSS to Account Takeover via x-ghost-preview | CVE-2026-53943 | CryptoCat's Blog
Root cause analysis of CVE-2026-53943 in Ghost CMS, an unauthenticated cache-poisoning XSS where one anonymous request poisons any caching layer in front of Ghost with attacker-controlled JavaScript t...
cryptocat.me
An SQLi I found in Photo Gallery by 10Web was disclosed this week! cryptocat.me/blog/researc...
Photo Gallery by 10Web Compact Album Second-Order Blind SQL Injection | CVE-2026-9829 | CryptoCat's Blog
Root cause analysis of CVE-2026-9829 in Photo Gallery by 10Web, where compact album shortcode sort direction was stored then later reached an album ORDER BY clause and allowed Contributor+ time-based ...
cryptocat.me
Writeup coming 🔜 github.com/TryGhost/Gho...
Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
### Impact When Ghost is behind a shared caching layer that results in cached content being shared between different visitors (e.g., Fastly, Cloudflare, nginx proxy_cache, and others), an unauth...
github.com
New video about the argument injection bug I found in Gogs! youtu.be/wt6l_5VB91A
Rebase Before Merging? More Like RCE Before Merging (Gogs Zero Day)
YouTube video by CryptoCat
youtu.be
Found an unpatched RCE in Gogs 👀 Any authenticated user can get code execution on the server through argument injection into git rebase. Full @rapid7.com writeup + #Metasploit module available now! 🔗 www.rapid7.com/blog/post/ve...
New episode of the @rapid7.com podcast! 👀 @stephenfewer.bsky.social joins @fulmetalpackets.bsky.social and myself to talk about the latest SD-WAN auth bypass - available now in the Metasploit framework 😎 www.youtube.com/watch?v=tg4T...
Hacktics and Telemetry, E6: Cisco SD-WAN Zero-Days, Mythos AI Evaluations, and Pwn2Own Drama
YouTube video by Rapid7
youtube.com
That's a wrap on Pwn2Own Berlin 2026! 🏆 $1,298,250 awarded. 47 unique 0-days. 3 days of absolute chaos. And talk about main character energy - congrats to DEVCORE for claiming Master of Pwn with 50.5 points and $505,000 - they never slowed down. See you next year! #Pwn2Own #P2OBerlin
Quick video about the new SD-WAN Auth bypass (CVE-2026-20182) discovered by @rapid7.com Labs 👀 I say quick, because @stephenfewer.bsky.social will be joining @fulmetalpackets.bsky.social and myself to talk all about it (and more) in the next podcast - dropping Thursday 🔥 youtu.be/_AxRbX_GLiA
Authenticate? No Thanks, I'll Skip It! (CVE-2026-20182)
YouTube video by CryptoCat
youtu.be
Another bug I found in ProfileGrid was disclosed this week. Broken access control! cryptocat.me/blog/researc...
ProfileGrid Missing Authorization Allows Subscriber+ Arbitrary Group Joining | CVE-2026-4609 | CryptoCat's Blog
Root cause analysis of CVE-2026-4609 in ProfileGrid, where a nonce-only AJAX invite flow lets Subscriber-level users add themselves or other registered users to closed and paid groups.
cryptocat.me
Recapping Day One of #Pwn2Own Berlin 2026! It was an amazing day of research on display with more than $500,000 awarded. Tomorrow looks to be even better. youtu.be/yb29BkA8uO4
Recapping Day One of Pwn2Own Berlin 2026
YouTube video by TrendAI Zero Day Initiative
youtu.be
Wake up babe, new SD-WAN auth bypass dropped 😼 Stay tuned for the @metasploit-r7.bsky.social module 👀 www.rapid7.com/blog/post/ve...
CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)
While researching a critical authentication bypass vulnerability, CVE-2026-20127, which was exploited in-the-wild, Rapid7 Labs discovered a new authentication bypass vulnerability affecting Cisco Cata...
rapid7.com
An SQLi I found in ProfileGrid was disclosed this week. Here's the full writeup and patch review! cryptocat.me/blog/researc...
ProfileGrid Subscriber+ SQL Injection via rid Parameter | CVE-2026-4608 | CryptoCat's Blog
Root cause analysis of CVE-2026-4608 in ProfileGrid, where the messaging profile view trusted the rid parameter inside a raw SQL fragment and exposed authenticated SQL injection to Subscriber-level us...
cryptocat.me
Did you catch @jorianwoltjer.com's cool XSS chain on RoundCube mail? 👀 If not, you can hear (and see) all about it in the latest episode of the @rapid7.com podcast! youtu.be/A05dD51mLyo
Hacktics and Telemetry, E5: A Masterclass in XSS, The Copyfail Exploit and Metasploit MCP
YouTube video by Rapid7
youtu.be
An XSS I found in Elementor was disclosed yesterday, here's the writeup! cryptocat.me/blog/researc...
Elementor REST API Form-Encoded Stored XSS via _elementor_data | CVE-2026-6127 | CryptoCat's Blog
Root cause analysis of CVE-2026-6127 in Elementor Website Builder, where form-encoded REST API requests bypass _elementor_data sanitisation and lead to Contributor+ stored XSS.
cryptocat.me
My writeup for the "Bucket Vault" challenge by @pwnii.bsky.social (@yeswehack.bsky.social) 💜 cryptocat.me/blog/ctf/mon...
Signed Directory Traversal via Filename Sanitisation | YesWeHack Dojo: Bucket Vault | CryptoCat's Blog
YesWeHack Dojo #50 writeup: the app checks the original filename, then signs a cleaned-up version of it, letting us turn a public path into directory traversal
cryptocat.me
We've launched a new free Web Security Academy topic on exploiting AI-powered security scanners! Learn how to use indirect prompt injection to steal data, cause damage & trigger exploit chains! Dive in here: portswigger.net/web-security...
AI-powered scanner vulnerabilities | Web Security Academy
Application security teams often deploy AI-powered scanners that use Large Language Models (LLMs) to scan web applications for vulnerabilities. While ...
portswigger.net
Mozilla says Mythos helped identify 271 vulnerabilities in Firefox 150. I went through the commits, CVEs, and bug links to see what that number really means. My takeaway: relax folks. xark.es/b/mythos-fir...
A quick look at Mythos run on Firefox: too much hype?
A closer look at Mozilla's Firefox 150
xark.es
My first YT video of 2026! 😳 We'll review @rapid7.com's analysis of CVE-2026-20127 - written by me! 😊 youtu.be/6vgpwr37nR0
This Bug Lets You Skip Cisco SD-WAN Authentication
YouTube video by CryptoCat
youtu.be