ʞʞıdɐɔoɥƆ
Security Researcher & Exploit Developer
at VulnCheck
Breaking, building, and documenting. Vulnerability research, exploit development, and offensive security.
Latest
Virtualizor: The Login Parameter That Skips the Login
VulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts the injected string back to the integer the query expects.
Read more →Recent
all →FileRun: Four More Ways to Run Your Files
Four authenticated RCEs in FileRun. A contact-sheet handler and a settings test endpoint run attacker input through a shell, and a delegated administrator turns a control-panel field into stacked SQL that a permission-blob deserialization weaponizes into a webshell. All fixed in 2026.3.0.
Inside BitAIM+: Reverse Engineering a Commercial Carrom Pool Cheat
A commercial Android cheat sells itself as an AI aim assistant for Carrom Pool. I pulled it apart: a rebranded VirtualApp container, YAHFA inline hooking, five hook plugins hidden as plaintext base64 inside a native library, a hand-written devirtualization of Google's PairIP protection, direct memory reads into the game's physics engine, and a paywall whose two tiers are hardcoded constructor calls. There is no AI anywhere. There is not even a physics simulation.
FileRun: When Your File Manager Runs Your Files
OS Command Injection in FileRun's thumbnail generation - authenticated (CVSS v4 8.7) or via public 'file request' weblinks (CVSS v4 9.2). The extractors wrap file paths in double quotes and pass them to exec(), but the filename sanitizer allows $(){}` - enough for command substitution. The weblink path uploads a malicious filename via anonymous upload, then self-triggers thumbnail generation through the public listing.
Aimy Captcha-Less Form Guard: The Anti-Bot Plugin That Hands Bots the Keys
An unauthenticated PHP object injection in Aimy Captcha-Less Form Guard for Joomla, where a repeating-key XOR published alongside its own ciphertext turns every protected form into an unserialize() sink and, on Joomla 3.9 through 5.2.1, into remote code execution.
Monsta FTP: An SSRF Blocklist That Forgot IPv6 Exists
An unauthenticated SSRF in Monsta FTP 2.14.4. The product ships a real SSRF blocklist that correctly blocks 127.0.0.1, 169.254.169.254 and RFC1918, then forgets that ::ffff:169.254.169.254 is the exact same host. One missing normalization, both gates bypassed, and a static AAAA record is all it takes.
NVIDIA GEN3C: Unauthenticated RCE via Pickle Deserialization in Inference API
A critical unauthenticated RCE vulnerability in NVIDIA's GEN3C project. Two FastAPI inference endpoints deserialize raw HTTP POST bodies with pickle.loads() without any authentication, giving instant code execution to anyone with network access.
NEVER GONNA
GIVE YOU UP
You were warned.