slcyber.io resources

slcyber.io

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-10-29.

RCE 4 AI 1 Fuzzing 1 Secrets 1 XSS 1

Date Added	Resource	Excerpt
2026-10-29 2026	Cache Me If You Can: XSS in Cloudflare's /cdn-cgi/image/XSS	Writeup detailing an XSS vulnerability in Cloudflare's `/cdn-cgi/image/` endpoint. This attack chains an SVG sanitizer bypass in `svg-hush`, a Chromium gadget exploiting `Cache-Control: no-cache="Content-Security-Policy"`, and a history navigation trick to bypass CSP and achieve arbitrary JavaScript execution on user-facing hostnames. The technique leverages how `xml-rs` serializes namespace declarations without escaping, and how Chromium selectively excludes headers from its cache.
2026-10-21 2026	How practical is 100k requests per second? Introducing h3fuzz Fuzzing	Tool implementing PortSwigger's HTTP/3 research, h3fuzz forked from ffuf, integrates a web UI and enables significantly faster request rates. It leverages QUIC and HTTP/3 to overcome HTTP/1.1 and HTTP/2 limitations, allowing for thousands of requests per second. While practical 100k requests per second remains rare due to server support and WAFs, h3fuzz offers enhanced discovery fuzzing and potential for TOCTOU attacks, using quic-go for its QUIC implementation and an adaptive connection pool.
2026-10-10 2026	A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline RCE	Library detailing two vulnerabilities in Discourse's default configuration: a cache poisoning attack leading to CSP bypass and JavaScript execution for anonymous users via a modified `color_scheme_id` cookie, and an arbitrary file read stemming from a TOCTOU race condition in the image upload pipeline, exploitable with Trust Level 0 and involving ImageMagick and GhostScript.
2026-09-10 2026	Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine RCE	Library detailing a Remote Code Execution (RCE) vulnerability in the Goja JavaScript engine, found within applications like Grafana k6, PocketBase, Nuclei, and Zendesk. The vulnerability arises from an out-of-bounds heap write in `TypedArray` methods (`with` and `toReversed`) due to an incorrect offset calculation, exacerbated by Go's `unsafe` package bypassing runtime bounds checking. Successful exploitation involves heap spraying and manipulating `ArrayBuffer` structures to achieve arbitrary read/write capabilities, ultimately leading to sandbox escape and code execution.
2026-07-21 2026	I found a WordPress RCEs with GPT5.6 and $25 AI RCE	Tool that leverages GPT5.6 Sol Ultra to discover RCE vulnerabilities in WordPress, demonstrated by finding a pre-authentication SQL injection that escalates to RCE. The process involved adapting a prompt designed for mathematical conjecture solving to analyze WordPress source code, utilizing multi-agent exploration for six hours, and costing approximately $25 in LLM usage. The tool is available at wp2shell.com for users to check their WordPress instances.
2026-07-15 2026	Smashing the ServiceNow Sandbox – Pre Authentication RCE RCE	Library for finding pre-authentication RCE vulnerabilities in ServiceNow, focusing on the GlideRecord system and its "javascript:" filter operator. This resource details how to leverage the `javascript:` prefix within `addQuery` calls to achieve remote code execution, bypassing ServiceNow's additional script sandbox by exploiting the `gs.include()` function to access script includes and ultimately gain full compromise of the instance and connected proxy servers.
2026-06-27 2026	CargoWise WebTracker - The keys were in the cargo Secrets	Library for securing CargoWise WebTracker, a logistics platform. This resource details hardcoded symmetric keys (3DES and AES-256-CBC) used for encrypting query string parameters and authentication tokens. It demonstrates how these keys enable authentication bypass via an "auto-login" feature and session persistence on handler endpoints, potentially allowing unauthorized access to sensitive shipment and booking information.