PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Finding XSS in Salesforce Aura Components: How XBOW Got Creative

xbow.com | vulnerability | #ai-security | #vulnerability-research | #web-security | #xss | #ai-pentesting | #salesforce | #aura
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Chronicles XBOW's XSS discovery in Salesforce Aura components (the /sfsites/aura endpoints) through methodical reconnaissance and creative parameter fuzzing; fixed via coordinated disclosure.
Published
Collected

Related coverage

research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Postmortem on Next.js Middleware bypass
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
vulnerability · horizon3.ai
[CVE-2020-35124] Unauthenticated XSS to Remote Code Execution Chain in Mautic < 3.2.4
# Unauthenticated XSS to Remote Code Execution Chain in Mautic ` page. Below we dump the contents of the `/etc/passwd` file on the Mautic server. And upgrading to a reverse shell using a Python...
research · projectblack.io
Salesforce Penetration Testing Fundamentals
Salesforce penetration testing fundamentals: enumerate custom objects and fields for access-control issues, review Apex code for SOQL injection and IDORs, and dump objects with aura-dump.
Back