in ResponsibleDisclosure, Cybersecurity, CVE, MITRE, OffensiveSecurity 10-Sep-2025

CVE-2025-57520 – Stored XSS in Decap CMS (<= 3.8.3)

This vulnerability has been assigned CVE-2025-57520 by MITRE.

Vulnerability Summary

• Vulnerability Type: Stored Cross-Site Scripting (XSS)
• Affected Versions: Decap CMS <= 3.8.3
• Affected Component: Admin Panel → Content Preview Renderer (title, tags, description, body)
• Impact: Session hijacking, credential theft, arbitrary JavaScript execution in privileged user context
• Discoverer: Onurcan Genç – Independent Security Researcher

Scenario Flow

1. Contributor (low privilege) injects a malicious payload into a blog entry.
2. Editor/Admin (high privilege) later opens the entry in the preview panel.
3. The payload executes in the privileged user’s browser context.

The vulnerability was verified under both contributor and editor roles. The most severe impact is observed when an admin user views the malicious entry in preview mode, leading to stored XSS execution in the privileged context.

in Cybersecurity, Project, OffensiveSecurity 07-Sep-2025

NucAIScan: An AI-Powered Web Application Security Scanner

Hello everyone! About a week ago, I started working on a new idea that turned into a project I now call NucAIScan. Initially, I had no plans to build anything related to offensive security or cyber threat intelligence since my main focus was preparing for the eWPTX exam. But sometimes, inspiration shows up when you least expect it.

During a holiday break, a bug bounty friend of mine said:

“If we could automate scanners like Acunetix for large scopes, we could literally earn rewards just by running them and submitting the results.”

in Cybersecurity, eWPT, Cybersecurity, Penetration Testing 29-Aug-2025

eWPT Exam Guide: Strategies, Study Materials, and Final Takeaways

Hi everyone! In this article, I’d like to share my eWPT (eLearnSecurity Web Application Penetration Tester) exam experience. I’ll walk you through my expectations before the test, my exam-day approach, the materials I used to prepare, and some final thoughts.

Overall, the exam does a good job covering what a web application penetration tester should know. However, it is heavily focused on CMS exploitation (WordPress, Drupal, Joomla), which doesn’t always reflect the wide variety of applications we encounter in real-world scenarios.