DEV Community

#appsec

Application security topics beyond the web, including mobile and desktop applications.

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
IDOR vulnerability: a local example with PUT and DELETE
alygg77 profile

IDOR vulnerability: a local example with PUT and DELETE

#security #webdev #appsec #idor
Comments
7 min read
SQL injection example: login bypass and UNION reads on a local API
alygg77 profile

SQL injection example: login bypass and UNION reads on a local API

#security #webdev #appsec #sql
Comments
8 min read
Race condition vulnerability in a single-use coupon endpoint
alygg77 profile

Race condition vulnerability in a single-use coupon endpoint

#security #webdev #appsec #concurrency
Comments
8 min read
Every read route called the public-API check except one: unauthenticated locale lookup in ApostropheCMS (CVE-2026-113668)
santosh_kumarpuppala_96e profile

Every read route called the public-API check except one: unauthenticated locale lookup in ApostropheCMS (CVE-2026-113668)

#security #javascript #node #appsec
Comments
5 min read
Inviting an Editor was blocked, promoting an Author to Editor wasn't: a role-check shortcut in Ghost (CVE-2026-105678)
santosh_kumarpuppala_96e profile

Inviting an Editor was blocked, promoting an Author to Editor wasn't: a role-check shortcut in Ghost (CVE-2026-105678)

#security #javascript #node #appsec
Comments
7 min read
🍪 CSRF in 2026: Why SameSite Isn't Your Fix (and What Is)
krishna_kumar_75bdf350b26 profile

🍪 CSRF in 2026: Why SameSite Isn't Your Fix (and What Is)

#security #webdev #appsec #python
Comments
9 min read
The role check passed, the group check was missing: cross-org IDOR in CiviForm (CVE-2026-107856)
santosh_kumarpuppala_96e profile

The role check passed, the group check was missing: cross-org IDOR in CiviForm (CVE-2026-107856)

#security #cve #java #appsec
Comments 1
6 min read
retrieve said 403. history_detail said 200. (Objects API, CVE-2026-82411)
santosh_kumarpuppala_96e profile

retrieve said 403. history_detail said 200. (Objects API, CVE-2026-82411)

#security #cve #python #appsec
Comments
7 min read
🧪 Nuclei Regression Templates: Make Every Proven Bug Stay Fixed
krishna_kumar_75bdf350b26 profile

🧪 Nuclei Regression Templates: Make Every Proven Bug Stay Fixed

#security #appsec #devops #tutorial
Comments
11 min read
🔀 Open Redirects: Why Your ?next= Check Fails, and How to Prove It
krishna_kumar_75bdf350b26 profile

🔀 Open Redirects: Why Your ?next= Check Fails, and How to Prove It

#security #webdev #appsec #javascript
Comments
9 min read
Group and session filters checked the column name, profile filters didn't: ClickHouse SQL injection in OpenPanel (CVE-2026-88890)
santosh_kumarpuppala_96e profile

Group and session filters checked the column name, profile filters didn't: ClickHouse SQL injection in OpenPanel (CVE-2026-88890)

#security #typescript #appsec #database
Comments
7 min read
One exclamation mark switched off the check: forged alarm acknowledgements in OpenNMS (CVE-2026-19182)
santosh_kumarpuppala_96e profile

One exclamation mark switched off the check: forged alarm acknowledgements in OpenNMS (CVE-2026-19182)

#security #java #appsec #networking
Comments
6 min read
Allowed to view the Location, handed the Device: a GraphQL permission gap in Nautobot (GHSA-mfwj-pjgx-22v2)
santosh_kumarpuppala_96e profile

Allowed to view the Location, handed the Device: a GraphQL permission gap in Nautobot (GHSA-mfwj-pjgx-22v2)

#security #graphql #python #appsec
Comments
9 min read
The viewer checked the domain, the delete button didn't: cross-tenant quarantine IDOR in MailWatch (CVE-2026-85749)
santosh_kumarpuppala_96e profile

The viewer checked the domain, the delete button didn't: cross-tenant quarantine IDOR in MailWatch (CVE-2026-85749)

#security #php #appsec #email
Comments
6 min read
One Range header skipped the firmware assignment check: CVE-2026-16454 in Eclipse hawkBit
santosh_kumarpuppala_96e profile

One Range header skipped the firmware assignment check: CVE-2026-16454 in Eclipse hawkBit

#security #cve #java #appsec
Comments
8 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
⌂ 换网址