Hey, I'm Chris! A cybersecurity researcher and content creator from United States.
View my vulnerability discoveries and responsible disclosure timeline
A low-privileged Contributor can permanently take over a Ghost CMS site Owner account through unsanitized embed card HTML in the admin panel. Ghost declined to patch it.
The target was a Flask-based web application vulnerable to multiple critical security flaws...
As a member of the Hack Smarter Red Team, you have been assigned a web application penetration test on a clients employee portal.
