Category: Tacklebox
The Tacklebox is your one-stop reference guide to unraveling the intricate world of scams and fraudulent schemes. This comprehensive resource is designed to equip you with the knowledge and insights needed to recognize, understand, and protect yourself against various types of scams and social engineering tactics.
-
PHP2Shell: Unauthenticated Remote Code Execution Vulnerabilities in PHP Core
Explore the PHP2Shell vulnerabilities allowing unauthenticated remote code execution in PHP Core, analyzing CVE-2026-109618 and CVE-2026-109619.
-
Exploiting Fortinet FortiSIEM: CVE-2026-106173 Path Traversal to RCE
Exploration of Fortinet FortiSIEM CVE-2026-106173 vulnerability leveraging gRPC path traversal for remote code execution.
-
Exploiting CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing
Dive into the CVE-2026-102764 vulnerability exploiting BeyondTrust’s authentication bypass via spoofing.
-
Orphaned VBA Projects Inside DWG Files: New Phishing Vector Discovered
Explore the new phishing vector using Orphaned VBA Projects inside DWG files, its implications, and how red teamers can replicate its effectiveness.
-
Exploiting CVE-2026-76519: Cisco Secure Email Gateway Path Traversal Vulnerability
A breakdown of CVE-2026-76519, a vulnerability in Cisco Secure Email Gateway allowing file writing via path traversal.
-
Exploiting CVE-2026-104935: Ivanti Connect Secure Authentication Bypass and RCE
Detailed exploration of CVE-2026-104935 exploitation in Ivanti Connect Secure, focusing on authentication bypass leading to RCE.
-
Exploiting AhsayCBS: CVE-2026-105133 and CVE-2026-105134 Authentication Bypass and RCE
An in-depth examination of the recent AhsayCBS vulnerabilities exploitation, covering attack methodologies, technical breakdowns, and practitioner insights.
-
Exploiting CVE-2026-104935: Ivanti Connect Secure Authentication Bypass
Explore CVE-2026-104935: Ivanti Connect Secure vulnerability, allowing authentication bypass and unauthorized command execution.
-
Exploiting CVE-2026-102489: Zammad WebSocket Session Hijacking
Explore CVE-2026-102489: Understanding Zammad WebSocket session hijacking and its implications for security professionals.
-
Exploiting Strapi for Sensitive Information Disclosure: CVE-2023-22894
A deep dive into the exploitation of CVE-2023-22894, a Strapi vulnerability allowing attackers to access sensitive information through improper storage mechanisms.
-
Zammad CVE-2026-102489: From Session Leak to Remote Code Execution
Explore the Zammad vulnerability CVE-2026-102489, where session leaks via WebSocket errors escalate to remote code execution, and learn how attackers exploit this flaw.
-
Exploiting CVE-2026-102489: Leveraging Zammad WebSocket Vulnerability for RCE
Explore how CVE-2026-102489 enables RCE through WebSocket errors in Zammad, uncovering potential impacts for security teams.
-
Exploiting Atlassian CVE-2026-21589: Unauthenticated Arbitrary File Access
Dive into CVE-2026-21589, a critical Atlassian vulnerability, revealing how attackers gain unauthorized access to sensitive files.
-
Exploiting Zammad CVE-2026-102489: Session Leak to Remote Code Execution
An in-depth analysis of CVE-2026-102489 in Zammad, exploiting a session leak to achieve remote code execution. We examine the attack path and implications for users.
-
Abuse of RMM Tools in Recent Phishing Campaigns
Explore how recent phishing campaigns exploit RMM tools like ScreenConnect to elevate social engineering tactics with precision and technical finesse.
-
Exploiting CVE-2026-102489 and CVE-2026-102490 in Zammad: A Case of Session Fixation and Privilege Escalation
Exploring the exploitation of vulnerabilities in Zammad for session fixation and privilege escalation, highlighting the technical strategies used to achieve these breaches.
-
ScreenConnect Client (Ab)used by Attackers: A Novel Approach
Explore how attackers leverage ScreenConnect Client, avoiding complex malware by using legitimate applications to bypass defenses.
-
Exploiting CVE-2026-76504: Cisco Catalyst SD-WAN Manager’s API Authentication Bypass
An in-depth exploitation breakdown of CVE-2026-76504 highlighting the critical vulnerability in Cisco Catalyst SD-WAN Manager enabling API authentication bypass.
-
ScreenConnect Abuse by Threat Actors: A New TTP
Explore how threat actors exploit ScreenConnect Client to launch attacks, leveraging legitimate software for malicious purposes.
-
Exploiting CVE-2026-76504: Cisco Catalyst SD-WAN Manager API Vulnerability
Explore the exploitation of a critical vulnerability in Cisco Catalyst SD-WAN Manager that allows unauthenticated API access.