PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-15586] Vibe Hacking: Finding Auth Bypass and RCE in Open Game Panel

projectblack.io | research | CVE-2025-15586 | #rce | #authentication-bypass | #open-game-panel | #type-juggling | #cve-2025-15586
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Vibe hacking Open Game Panel: an MD5 type-juggling flaw enables login with magic-hash passwords (CVE-2025-15586), while a Semgrep-assisted LFI escalates to authenticated RCE via include().
CVE
CVE-2025-15586
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
research · aretiq.ai
CVE-2026-61967 — miniOrange OTP Verification Ultimate Member Password Reset Authentication Bypass
This research provides technical context that security teams can use for monitoring and validation.
research · aretiq.ai
CVE-2026-45434 — Apache OFBiz LoginWorker checkLogin Password-Change Flow Authentication Bypass RCE
CVE-2026-45434: OFBiz's checkLogin misreads the requirePasswordChange flow as success, letting attackers bypass locked accounts and reach unsandboxed ProgramExport for OS command execution.
Back