Root-cause analysis and exploitation of a format string vulnerability in a C binary (Hack.lu CTF 2025), chained with a stack-based buffer overflow to defeat canary and ASLR/PIE and reach arbitrary code execution via ROP.
Root-cause analysis and exploitation of a GitHub Actions CI/CD pipeline (Hack.lu CTF 2025). A pull_request_target misconfiguration is leveraged through heredoc injection into GITHUB_ENV, LD_PRELOAD hijacking, and Python module shadowing to cross a privilege boundary. From there, symlink-based Docker build-context manipulation and Problem Matcher abuse chain together to bypass secret redaction and exfiltrate a repository secret.
Wojtek
Part II of the CVE-2025-64112 writeup: weaponizing a stored XSS in the Statamic control panel into full Superadmin takeover. Admin-editable fields are rendered by Vue without v-pre or output encoding, so a {{constructor.constructor(...)}} payload executes JavaScript in a Superadmin's session. Two proof-of-concept chains are shown — a silent password change on versions ≤5.21.0, and an email swap on 5.22.0 (after password changes were hardened) to hijack the account via password reset.
Part I of the CVE-2025-64112 research: multiple stored XSS vectors in the Statamic control panel, rooted in Vue rendering admin-editable fields without the v-pre directive. Because Vue compiles mustache {{ }} expressions client-side, unescaped stored input is treated as executable template code — a {{this.constructor.constructor('alert(document.cookie)')()}} payload runs in an admin's browser. Six control-panel sections (collections, navigation, taxonomies, asset containers, globals, forms) were affected on versions ≤4.42.0. Part II chains this into full Superadmin takeover.
