PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Big Bugs | Episode 5: Big XSS–Not an Oxymoron

bugcrowd.com | vulnerability | #bug-bounty | #account-takeover | #xss | #bugcrowd | #vulnerability-analysis | #exploit-chain | #big-bugs-podcast
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Big Bugs Episode 5 argues that 'big XSS' is not an oxymoron: though XSS is often dismissed as low-hanging fruit, exploit chains show it can drive ransomware and full account takeover.
Published
Collected

Related coverage

vulnerability · netspi.com
CVE-2026-78902: XSS to RCE in pfSense with one DNS request
NetSPI reports CVE-2026-78902, a stored cross-site scripting issue in the pfSense pfBlockerNG package that can be escalated to remote code execution with a single DNS request.
blog · bugcrowd.com
Big Bugs Podcast Episode 2: ImageTragick Up Close
Big Bugs Episode 2 examines ImageTragick, the notorious ImageMagick vulnerability. Jason Haddix traces its disclosure and patch timeline, implications for developers, and image processing alternatives.
research · yokai.hakaisecurity.io
Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta
# Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta RESEARCHER **Pedro Cruz "gankd"** READ TIME**12 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Sumário ▸ Introdução ▸...
research · yokai.hakaisecurity.io
Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion
# Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion RESEARCHER **Pedro Cruz "gankd"** READ TIME**11 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Table of contents ▸...
vulnerability · bugcrowd.com
Bugcrowd Announces the Availability of Self-Service Vulnerability Disclosure Programs
Bugcrowd launches self-service Vulnerability Disclosure Programs: a structured intake and triage pipeline for bug reports, with managed triage for the first 15 or 75 submissions.
vulnerability · bugcrowd.com
XSS Bugs that Prove the Danger in ‘XSS-Fatigue’
Bugcrowd pushes back on XSS-fatigue: over 25% of its submissions are XSS, and chained XSS plus CSRF attacks have enabled account takeover. Real cases and the updated VRT show XSS is still high impact.
Back