PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploiting Web Worker XSS with Blobs

lab.ctbb.show | research | #xss | #exploitation | #web-worker | #blob
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Ways to turn XSS in a Web Worker into full XSS, covering known tricks and a new generic exploit using Blob URLs with the Drag and Drop API
Published
Collected

Related coverage

vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
research · lab.ctbb.show
Total.js RCE gadgets all around
RCEs, RCEs…they are all around and Total.js framework will be in our scope this time
research · lab.ctbb.show
Vega CVE-2025-59840 - Unusual XSS Technique toString gadget chains
A writeup on the technical details of a Vega Visualization library XSS bug that uses interesting techniques to get controlled JS function execution.
research · lab.ctbb.show
Write Path Traversal to a RCE Art Department
# Write Path Traversal to a RCE Art Department ~/authors/fsi - profile fsi * * * Diyan Apostolov Nov 28, 2025 CriticalThinking Research members are treated as artists thus here is my small and...
research · lab.ctbb.show
Challenge Two - Stranger XSS
The second challenge of an XSS miniseries leading up to a writeup on a bug in an open source library.
research · lab.ctbb.show
Challenge One - Strange XSS
A cool challenge introducing an XSS miniseries leading up to a writeup on a bug in an open source library.
Back