PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How XBOW Turned a JavaScript Hint Into a Working File Inclusion

xbow.com | blog | #bug-bounty | #vulnerability-research | #path-traversal | #lfi | #javascript-analysis | #blackbox-testing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Shows XBOW converting JavaScript analysis of an avatar-upload flow into a working local file inclusion, after methodical path traversal and null-byte attempts on a download endpoint.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
High · vulnerability · github.com
WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)
While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · horizon3.ai
Apache CVE-2021-41773, CVE-2021-42013
We wanted to do something a little bit different with this post. Our vulnerability disclosures, exploit proof-of-concepts, and attack analysis blog posts have…
blog · hackenproof.com
How We Built an Autonomous AI Security Triager: From LLM to 20,000+ Real Reports
AI made bug hunters sharper, and report volume doubled. How HackenProof built an autonomous AI triager that now handles 70% of submissions.
Back