ctf-writeups

🏴 CTF Writeups & PoC Collection Documented solutions from Hac...

dvwa-webapp-vapt

dvwa-webapp-vapt Black-box penetration test of D...

PT-2026-76136

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::init sample timing table in libheif/sequences/track.cc stores an out-of-bounds chunk index m chunks.size into m presentation timeline when the number of chunks defined in the stco box is less than the numb...

CVE-2026-15248

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

CVE-2026-15248

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

CVE-2026-15248

The Meta Box WordPress plugin (versions before 5.13.1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability due to a lack of authorization checks. This flaw allows users with low-privilege roles, such as Contributor , to bypass permission checks and permanently delete arbitrary medi...

EUVD-2026-51935

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

CVE-2026-15248 Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

WordPress Meta Box plugin < 5.13.1 - Contributor+ Arbitrary Attachment Deletion vulnerability

Contributor+ Arbitrary Attachment Deletion vulnerability discovered by Duy in WordPress Plugin Meta Box – WordPress Custom Fields Framework versions 5.13.1...

CVE-2026-15248: Missing Authorization

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

Decoy Images Amplify Caption-Mediated Defenses against Encoded Jailbreaks

We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models VLMs: pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate ASR. The operative change is in the defense pipeline, not in the...

WordPress Meta Box AIO plugin <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by Austin Ginder in WordPress Plugin Meta Box AIO versions = 3.8.0...

CVE-2026-5056

A stack-based buffer overflow in GStreamer's qtdemux component allows attackers to execute arbitrary code via specially crafted input. This occurs due to insufficient data length validation when parsing UncompressedFrameConfigBox structures. Mitigation Do not open, preview, or auto-index untruste...

Exploit for Type Confusion in Handlebarsjs Handlebars

POC for CVE-2026-33937 this is a poc for CVE-2026-33937 that...

CVE-2026-44098

CVE-2026-44098 describes an unauthenticated OS command injection in an OCPP backend/agent stack accessible via firewall-bypass. An attacker can control the backend and execute arbitrary commands as the limited user charx-oa, potentially interrupting charging. The connected documents provide the v...

CVE-2026-44098 OS Command Injection in OCPP Agent via charge_box_id

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted...

CVE-2026-44098 OS Command Injection in OCPP Agent via charge_box_id

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted...

Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems

Autonomous multi-agent systems AMAS built on large language models LLMs, such as Hermes, increasingly rely on inference-time harnesses to coordinate reasoning and action. Constructing these harnesses requires substantial engineering effort and computational resources, as they are iteratively...

CVE-2026-5056

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2026-5056

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...