Exploitarium Kill Chain, Part 1: From Browser to Database
A hypothetical attack scenario in which a single link click leads to access to a production database. We analyse how six vulnerabilities combine into one attack.
08 / JOURNAL04 ARTICLES
Security research
and technical notes
Research notes examining the causes of vulnerabilities and the paths attackers take. Articles originally published on Medium, presented here in English.
FEATURED RESEARCHCVE-2025-45055
CVE-2025-45055
Technical analysis
Administrator privilege escalation through an SVG attachment. We examine the cause of CVE-2025-45055, how to reproduce it and how to address it.
Read the CVE analysisRead article
CVE-2025-45055: Privilege Escalation in Silverpeas 6.4.2 via SVG Injection
A regular user could create an administrator account using a single SVG file attached to a calendar event. We examine the cause, reproduction steps and remediation.
The Enemy of My Enemy Is My VPN: VPN Tunnels Across Multiple Countries
Can chaining VPNs in different countries improve anonymity? We explore the idea and a Kali Linux configuration example.
Establishing a Reverse Shell Through WAR Deployment in a Java Portlet
WAR file uploads can lead to server-side command execution. We reproduce this in a Java portlet environment and examine countermeasures.
From research to security assessments
We apply our experience in analysing vulnerability causes and attack paths to Web & API and AI security assessments.