#webA flaw that comes from a site printing user input to the page without checking it; the attacker's code runs in someone else's browser.
Recent posts
2026
- What Is XSS? The Basics and a Hands-On DVWA Demo
- What Is Host Header Injection? Detection to Exploitation with Burp
#webThe Host header is entirely under the user's control; when some applications trust it too much, the password reset link goes to the attacker's server.
- Unauthenticated CRLF Injection in cPanel/WHM (CVE-2026-32993)
#cveA pre-auth CRLF injection in cPanel, patched on May 13, 2026; data written to the status parameter is added to the response header without sanitization.
- SSL Bypass via DNS Cluster in cPanel (CVE-2026-32992)
#cvecPanel's DNS Cluster module never verifies the other side's certificate on the TLS connection; with CVE-2026-32992, credentials between clusters are exposed.
- ActiveMQ Fileserver RCE: Manual curl and Metasploit (CVE-2016-3088)
#cvePut the two forgotten checks in the fileserver component of Apache ActiveMQ before 5.14.0 side by side and you get a root shell.
Projects
- evren-mcp
#mcp#pythonConnects EVREN, the national AI platform of Türkiye's Presidency of Defence Industries (SSB), to Claude Code. Just say “train a small model on this dataset”: it shows the cost, waits for your approval, starts the training and brings back the result.
