ILTOSEC

security research

iltosec

writeups & research

Blog

5 posts

categories

all Rce Xss CVE Ransomware File Upload Bypass Host Header Injection Authentication Bypass SSTI Command Injection Vulnerability Research Cloud AWS Injection Account Takeover

tags

Rce CMS CVE Ransomware File Upload Bypass snipe-it idor authorization-bypass privilege-escalation information-disclosure enumeration misconfiguration aws-s3 SQLI Account Takeover

Rce·Vulnerability Research · Rce·CMS

CVE-2026-53767 & CVE-2026-53768: Authenticated RCE via Chained Upload Path Bypass in Chyrp Lite

Technical breakdown of CVE-2026-53767 and CVE-2026-53768: a chained RCE in Chyrp Lite ≤ 2026.01 via uploads_path blocklist bypass and missing file extension validation. Full PoC included.

118 0 4 min read

Rce·File Upload Bypass·Command Injection · Rce·CMS·File Upload Bypass

EspoCRM v9.3.4 Authenticated Remote Code Execution via Malicious Extension Upload

Explore the technical analysis of the Authenticated Remote Code Execution (RCE) vulnerability in EspoCRM <= v9.3.4. Learn how malicious extension uploads can lead to full OS command execution and find mitigation strategies. Official PoC and exploit details included.

386 1 3 min read

Rce·CVE · Rce·CMS

.NET Deserialization Leading to Remote Code Execution (CVE-2019-18211)

This blog post explains the black-box exploitation of Composite C1 CMS via CVE-2019-18211. The deserialization vulnerability in the EntityTokenSerializer class allows attackers to achieve remote code execution (RCE) on the server. Step-by-step attack and mitigation recommendations are provided.

1328 13 3 min read

Host Header Injection · CMS

Host Header Injection Vulnerability in Plone CMS 6.0.13 - A Security Risk for Password Reset Process

Learn about the Host Header Injection vulnerability in Plone CMS 6.0.13, its impact on password reset emails and URL redirection, and recommended mitigations to protect your web application from malicious attacks.

1592 4 4 min read

Xss·CVE · CMS·CVE

Django CMS 4.1.3 Stored XSS Vulnerability: Exploiting the Page Title Field

CVE-2024-11319 Discover the stored XSS vulnerability in Django CMS 4.1.3 that affects the Page Title field. Learn about the security risks, exploitation methods, and remediation strategies to protect your site from potential attacks. CVE-2024-11319 stored XSS vulnerability, Django CMS 4.1.3, CVE-2024-11319, JavaScript injection, Django CMS 4.1.3 CVE-2024-11319, admin panel security, Cross-Site Scripting, security patch, CVE, content security policy, input sanitization

4585 15 3 min read