samcurry.net resources

samcurry.net

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-17.

Date Added	Resource	Excerpt
2026-08-17 2026	Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform AuthZ Secrets	Researchers discovered critical security flaws in points.com, the platform powering numerous airline and hotel rewards programs, between March and May 2023. These vulnerabilities could have allowed attackers to access sensitive customer data such as names, addresses, partial credit card information, emails, phone numbers, and transaction histories. The implications for millions of users' personal and financial security were significant.
2026-08-17 2026	Hacking Millions of Modems (and Investigating Who Hacked My Modem)SSRF XXE	The author encountered a strange event on their home network while exploiting a blind XXE vulnerability. To exfiltrate files, they set up an AWS box with a Python webserver. This incident led to an investigation into who might have hacked their modem, suggesting a potential connection between their security research and an intrusion.
2026-08-17 2026	Hacking Kia: Remotely Controlling Cars With Just a License Plate AuthZ	Researchers have discovered critical vulnerabilities in Kia vehicles that enable remote control of key functions, including starting the engine and unlocking doors, using only a license plate. These attacks can be performed remotely in approximately 30 seconds and affect all hardware-equipped vehicles, even those without a Kia Connect subscription. The exploit highlights significant security flaws in Kia's connected car systems.
2026-08-17 2026	Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel AuthZ	Researchers Shubham Shah and a collaborator discovered a critical security vulnerability in Subaru's STARLINK admin panel on November 20, 2024. This flaw granted them unrestricted access to all vehicles and customer accounts across the United States, Canada, and Japan. The vulnerability allowed for tracking and potentially controlling Subaru vehicles remotely through the compromised admin panel. No bounty payout amount was specified.
2026-08-17 2026	Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office AuthZ	Shubs Shah and an associate discovered a critical vulnerability in ClubWPT Gold's online poker platform in June 2025. This exploit would have granted an attacker complete access to the administrative back office, compromising all site functions. The specific payout for this discovery was not disclosed in the provided content.