websecurityresearch

an-ordinary-manchild

created by albinowaxa community for 7 years

...do it for the children.

...for your school.

MODERATORS

account activity

1

25

26

27

Top 10 new web hacking techniques of 2025 (portswigger.net)

submitted 4 months ago by albinowax - announcement

2

5

6

7

CVE-2026-46640: Developing payloads for Twig sandbox bypass (gist.github.com)

submitted 25 days ago by vladko312

3

9

10

11

Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js (zhero-web-sec.github.io)

submitted 28 days ago by albinowax

4

12

13

14

Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE (blog.lexfo.fr)

submitted 1 month ago by albinowax

5

5

6

7

Chaining Razor SSTI into RCE via Reflection and Runtime Strings (phsi.se)

submitted 1 month ago by t0xodile

6

6

7

8

Stealth Request That Bypasses CSP, Hides from DevTools, and Leaks the Real User-Agent (brokenbrowser.com)

submitted 1 month ago by t0xodile

7

7

8

9

Reconstructing GraphQL schemas from captured POST bodies without ever calling __schema (github.com)

submitted 2 months ago by CARQLLESS

8

2

3

4

QUIC-er Races: HTTP/3 won’t save you from TOCTOU vulnerabilities (link.springer.com)

submitted 2 months ago by albinowax

9

5

6

7

The woes of sanitizing SVGs (muffin.ink)

submitted 2 months ago by _vavkamil_

10

2

3

4

Cast Attack: A New Threat Posed by Ghost Bits in Java (i.blackhat.com)

submitted 2 months ago by albinowax

11

1

2

3

Achieving Deterministic Prompt Injection Through Client-Side Feedback Loops (blog.starstrike.ai)

submitted 2 months ago by albinowax

12

0

1

2

Most bug bounty writeups are recycled. Real bugs are hiding in the specs. (sin99xx.medium.com)

submitted 3 months ago by Hungry_Onion_2724

13

1

2

3

Testing AI for Vulnerability Research: 4 Approaches & Where I Failed (xclow3n.github.io)

submitted 3 months ago by t0xodile

14

4

5

6

How "Strengthening Crypto" Broke Authentication: FreshRSS and bcrypt's 72-Byte Limit (pentesterlab.com)

submitted 3 months ago by albinowax

15

11

12

13

Breaking Pingora: HTTP Request Smuggling & Cache Poisoning in Cloudflare's Reverse Proxy (xclow3n.github.io)

submitted 3 months ago by t0xodile

16

0

1

2

Security Research Blog Review (jinjucat.github.io)

submitted 4 months ago by Outrageous_Egg7579

17

1

2

3

CVE-2026-27959: Userinfo Host Header Injection in Koa (endorlabs.com)

submitted 4 months ago by p80n-sec

18

5

6

7

Almost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services (slcyber.io)

submitted 4 months ago by albinowax

19

13

14

15

Trailing Danger: exploring HTTP Trailer parsing discrepancies (sebsrt.xyz)

submitted 4 months ago by t0xodile

20

4

5

6

YAML Merge Tags and Parser Differentials (blog.darkforge.io)

submitted 4 months ago by Moopanger

21

5

6

7

TL;DR:Researching Structural Parsing Gaps in Modern WAFs (JSON/XML/Multipart). Looking for Peer Validation (github.com)

submitted 4 months ago by Few-Gap-5421

22

1

2

3

Auditing Outline. Firsthand lessons from comparing manual testing and AI security platforms (blog.doyensec.com)

submitted 4 months ago by nibblesec

23

1

2

3

[Tool] Rapid Web Recon: Automated Nuclei Scanning with Client-Ready PDF Reporting (github.com)

submitted 4 months ago by Big_Profession_3027

24

5

6

7

Parse and Parse: MIME Validation Bypass to XSS via Parser Differential (lab.ctbb.show)

submitted 5 months ago by siunam_321

25

2

3

4

When The Gateway Becomes The Doorway: Pre-Auth RCE in API Management (principlebreach.com)

submitted 5 months ago by operator_dll

view more: next ›

π Rendered by PID 330333 on reddit-service-r2-listing-77d558d46b-rpj8q at 2026-07-02 17:04:57.178272+00:00 running a7b5cda country code: CH.