Research and writing from the people who find the bugs.
Deep-dive vulnerability analyses and weaponized proofs-of-concept, first published by the Starfish founders on their own blogs and collected here. Each post links back to the original.
- 5
- published write-ups
- 5
- CVEs dissected
- 3
- founding researchers
5 posts
Sitecore CVE-2025-53690: Detailed Analysis & Weaponized POC
A sample ASP.NET machine key shipped in Sitecore's own deployment docs lets an attacker forge a valid ViewState and reach pre-auth RCE. Erik's full weaponized-PoC deep-dive: machine-key theory, ysoserial.net gadget selection, echoing output in one request, and a fileless in-memory route handler that survives the patch.
- An Ngo5 min
CVE-2024-24842: unauthenticated PHP object injection in the Knowledge Base WordPress plugin
An unauthenticated PHP object injection in the Knowledge Base for Documentation plugin (10,000+ installs): a view-counter cookie reaches maybe_unserialize() through an unauthenticated AJAX action. The original PoC, moved here from ancorn_'s blog.
CVE-2024-24842 9.8CVE AnalysisDeserializationRead - An Ngo4 min
CVE-2020-7769: command injection in Nodemailer's sendmail transport
Attacker-controlled input reaches Nodemailer's sendmail transport, where recipient values become sendmail command-line flags. The original PoC, moved here from ancorn_'s blog.
CVE-2020-7769 8.6CVE AnalysisWeb SecurityRead - Dau Hoang Tai15 min
Analysis CVE-2023-34362 & CVE-2023-35036 (MOVEit Transfer)
The MOVEit Transfer chain behind one of 2023's largest breach waves, taken apart end to end: an unauthenticated stacked SQL injection, privilege escalation, an IP-whitelist bypass, and unsafe .NET deserialization for RCE, plus the second injection CVE-2023-35036. Dau Hoang Tai's full code-level analysis (in Vietnamese).
CVE-2023-34362 9.8CVE AnalysisWeb SecurityRead - Dau Hoang Tai8 min
WSO2 CVE-2022-29464: analysis
Unrestricted arbitrary file upload leading to remote code execution in WSO2 products (CVE-2022-29464). Dau Hoang Tai's 1-day analysis: source setup and debugging, root cause, and the path to RCE (in Vietnamese).
CVE-2022-29464 9.8CVE AnalysisWeb SecurityRead