Exploitation of multiple vulnerabilities in SPIP to gain remote code execution from unauthenticated privileges (CVE-2026-72708, CVE-2026-72709, CVE-2026-72710).

Turning a SELECT-only PostgreSQL SQL injection into remote command execution when the injected role is a PostgreSQL superuser.

A technical deep dive into the discovery of an unauthenticated zero-day vulnerability in the Ninja Forms - File Uploads WordPress extension, which allows arbitrary file uploads, remote code execution, and full server compromise.

Uncovering bypasses, RCE, SSRF, CSRF, and account-takeover vulnerabilities in WSO2 products.

Exploitation of multiple vulnerabilities in GLPI to gain remote code execution from unauthenticated privileges.

A pre-authentication remote code execution vulnerability was found on Jupiter X Core Plugin <= 4.6.5 (CVE-2024-7772).