EverydaySparkling

Latest

SSRF via Referrer field in ChurchCRM v5.16.0

ChurchCRM doesn't validate the referrer properly and sends a HEAD request to the provided referrer. When a user is logged in and does a GET request to the Dashboard for example with an external referrer, a HEAD request is sent.

Stored Cross Site Scripting in webERP

Cross Site Scripting in OpenXE v1.12

First CVE: SQL Injection in PiHome v1.77

Passing the Certified Web Exploitation Expert (CWEE) – January 2025

Passing the Hack The Box Certified Bug Bounty Hunter (CBBH) – May 2024

CVE

SSRF via Referrer field in ChurchCRM v5.16.0

ChurchCRM doesn't validate the referrer properly and sends a HEAD request to the provided referrer. When a user is logged in and does a GET request to the Dashboard for example with an external referrer, a HEAD request is sent.

Stored Cross Site Scripting in webERP

Cross Site Scripting in OpenXE v1.12

First CVE: SQL Injection in PiHome v1.77

Certifications

Passing the Certified Web Exploitation Expert (CWEE) – January 2025

After months of dedication and persistence, I finally passed the Certified Web Exploitation Expert (CWEE) in January 2025! This certification was one of the toughest I’ve tackled, testing deep web security knowledge and advanced exploitation techniques. My first attempt in summer 2024 ended unsuccessfully, and my second attempt didn’

Passing the Hack The Box Certified Bug Bounty Hunter (CBBH) – May 2024