Phat Mai - Security Research & Writeups https://pzhat.id.vn Security research publication, vulnerability disclosures, CVE analyses, and technical writeups by Phat Mai. en CVE-2026-40478 Thymeleaf Template Injection: From Sandbox Bypass to Unauthenticated RCE https://pzhat.id.vn/research/cve-2026-40478 https://pzhat.id.vn/research/cve-2026-40478 Thu, 04 Jun 2026 17:00:00 GMT # CVE-2026-40478 Thymeleaf Template Injection: From Sandbox Bypass to Unauthenticated RCE ![image](https://hackmd.io/uploads/BkLrCXJZzg.png) ## Overview ... pentesting Web-Exploitation CVE Web CVE-2026-3359 WordPress Form Maker by 10Web Plugin <= 1.15.42 is vulnerable to a high priority SQL Injection https://pzhat.id.vn/research/cve-2026-3359 https://pzhat.id.vn/research/cve-2026-3359 Sat, 16 May 2026 00:00:00 GMT # Critical SQL Injection (CVE-2026-3359) in WordPress Form Maker by 10Web ![image](https://hackmd.io/uploads/rJC0RXuRbg.png) ## Overview Published: ... pentesting Web-Exploitation CVE Web WordPress CVE-2026-2628 WordPress All-in-One Microsoft 365 &amp; Entra ID / Azure AD SSO Login Plugin <= 2.2.5 is vulnerable to a high priority Bypass Vulnerability https://pzhat.id.vn/research/cve-2026-2628 https://pzhat.id.vn/research/cve-2026-2628 Sun, 03 May 2026 17:00:00 GMT # WordPress All-in-One Microsoft 365 &amp; Entra ID / Azure AD SSO Login Plugin <= 2.2.5 is vulnerable to a high priority Bypass Vulnerability ![image](https... pentesting Web-Exploitation CVE Web WordPress CVE-2026-2942 WordPress ProSolution WP Client Plugin <= 1.9.9 is vulnerable to a high priority Arbitrary File Upload https://pzhat.id.vn/research/cve-2026-2942 https://pzhat.id.vn/research/cve-2026-2942 Sun, 12 Apr 2026 17:00:00 GMT ## CVE-2026-2942 WordPress ProSolution WP Client Plugin <= 1.9.9 is vulnerable to a high priority Arbitrary File Upload ![image](https://hackmd.io/uploads/H1... pentesting Web-Exploitation CVE Web WordPress CVE-2026-3658 WordPress Simply Schedule Appointments Plugin <= 1.6.10.0 is vulnerable to a high priority SQL Injection https://pzhat.id.vn/research/cve-2026-3658 https://pzhat.id.vn/research/cve-2026-3658 Sun, 12 Apr 2026 17:00:00 GMT ## CVE-2026-3658 WordPress Simply Schedule Appointments Plugin <= 1.6.10.0 is vulnerable to a high priority SQL Injection ![image](https://hackmd.io/uploads/... pentesting Web-Exploitation CVE Web WordPress CVE-2026-1581 WordPress wpForo Forum Plugin is vulnerable to a high priority SQL Injection https://pzhat.id.vn/research/cve-2026-1581 https://pzhat.id.vn/research/cve-2026-1581 Tue, 30 Dec 2025 17:00:00 GMT # CVE-2026-1581 WordPress wpForo Forum Plugin is vulnerable to a high priority SQL Injection ![image](https://hackmd.io/uploads/BJipTiSdbe.png) ## Overvie... pentesting Web-Exploitation CVE Web WordPress CVE-2026-0702 WordPress VidShop Plugin <= 1.1.4 is vulnerable to a high priority SQL Injection https://pzhat.id.vn/research/cve-2026-0702 https://pzhat.id.vn/research/cve-2026-0702 Mon, 29 Dec 2025 17:00:00 GMT # CVE-2026-0702 WordPress VidShop Plugin <= 1.1.4 is vulnerable to a high priority SQL Injection ![image](https://hackmd.io/uploads/rkhOvm9vWg.png) # VidS... pentesting Web-Exploitation CVE Web WordPress CVE-2026-23550 WordPress Modular DS Plugin <= 2.5.1 is vulnerable to a high priority Privilege Escalation https://pzhat.id.vn/research/cve-2026-23550 https://pzhat.id.vn/research/cve-2026-23550 Sun, 28 Dec 2025 17:00:00 GMT # CVE-2026-23550 WordPress Modular DS Plugin <= 2.5.1 is vulnerable to a high priority Privilege Escalation ![image](https://hackmd.io/uploads/HyLArhXPZg.png... pentesting Web-Exploitation CVE Web WordPress CVE-2026-3459 WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.9.5 is vulnerable to a high priority Arbitrary File Upload https://pzhat.id.vn/research/cve-2026-3459 https://pzhat.id.vn/research/cve-2026-3459 Sat, 27 Dec 2025 17:00:00 GMT ## CVE-2026-3459 WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.9.5 is vulnerable to a high priority Arbitrary File Upload ![ima... pentesting Web-Exploitation CVE Web WordPress CVE-2026-2511 WordPress JS Help Desk Plugin <= 3.0.4 is vulnerable to a high priority SQL Injection https://pzhat.id.vn/research/cve-2026-2511 https://pzhat.id.vn/research/cve-2026-2511 Fri, 26 Dec 2025 17:00:00 GMT # CVE-2026-2511 JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter ![image](https://ha... pentesting Web-Exploitation CVE Web WordPress CVE-2026-2232 Product Table and List Builder for WooCommerce Lite Vulnerable To Unauthenticated Time-Based SQL Injection https://pzhat.id.vn/research/cve-2026-2232 https://pzhat.id.vn/research/cve-2026-2232 Thu, 25 Dec 2025 17:00:00 GMT # CVE-2026-2232 Product Table and List Builder for WooCommerce Lite Vulnerable To Unauthenticated Time-Based SQL Injection via 'search' Parameter ![image](ht... pentesting Web-Exploitation CVE Web WordPress WordPress HT Contact Form 7 Plugin <= 2.2.1 is vulnerable to a high priority Arbitrary File Upload https://pzhat.id.vn/research/cve-2025-7340 https://pzhat.id.vn/research/cve-2025-7340 Wed, 24 Dec 2025 17:00:00 GMT # WordPress HT Contact Form 7 Plugin <= 2.2.1 is vulnerable to a high priority Arbitrary File Upload ![image](https://hackmd.io/uploads/HJ5TohCu-g.png) ##... pentesting Web-Exploitation CVE Web WordPress CVE-2025-13329 File Uploader for WooCommerce https://pzhat.id.vn/research/cve-2025-13329 https://pzhat.id.vn/research/cve-2025-13329 Tue, 23 Dec 2025 17:00:00 GMT # CVE-2025-13329 File Uploader for WooCommerce <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data ![image](https://hackmd.io/uploads/SJGvzVA... pentesting Web-Exploitation CVE Web WordPress CVE-2025-68519 WordPress Brands for WooCommerce Plugin https://pzhat.id.vn/research/cve-2025-68519 https://pzhat.id.vn/research/cve-2025-68519 Mon, 22 Dec 2025 17:00:00 GMT # CVE-2025-68519 WordPress Brands for WooCommerce Plugin <= 3.8.6.3 is vulnerable to SQL Injection ![image](https://hackmd.io/uploads/ByI6-ltIbg.png) # Wo... pentesting Web-Exploitation CVE Web WordPress CVE-2025-14770 – Unauthenticated SQL Injection via “city” Parameter https://pzhat.id.vn/research/cve-2025-14770 https://pzhat.id.vn/research/cve-2025-14770 Sun, 21 Dec 2025 17:00:00 GMT ![image](https://hackmd.io/uploads/r1isJ3HLZl.png) # WordPress Shipping Rate By Cities Plugin ## Overview - CVE ID: CVE-2025-14770 - Affected Plugin: ... pentesting Web-Exploitation CVE Web WordPress Ysoserial Common Collections 3 Analyst (CC3) https://pzhat.id.vn/research/ysoserial-cc3-analyst https://pzhat.id.vn/research/ysoserial-cc3-analyst Sat, 20 Dec 2025 17:00:00 GMT # Ysoserial Common Collections 3 Analyst (CC3) ### Tổng quan CC3 (CommonsCollections3) trong ysoserial là một gadget chain dựa trên thư viện Apache Common... pentesting Web-Exploitation ysoserial Web Velocity Server Side Template Injection Challenge https://pzhat.id.vn/writeups/ssti-velocity https://pzhat.id.vn/writeups/ssti-velocity Fri, 19 Dec 2025 17:00:00 GMT # Velocity Server Side Template Injection Challenge ### Tổng quan về lab Velocity SSTI Đây là một lab mình thiết kế ra để demo và học về SSTI. Bên trong l... pentesting Web-Exploitation CTF Web Tryhackme Hammer challenge WriteUp https://pzhat.id.vn/writeups/tryhackme-hammer https://pzhat.id.vn/writeups/tryhackme-hammer Wed, 17 Dec 2025 17:00:00 GMT # TryHackMe Hammer Web Challenge WriteUp ![image-14](https://hackmd.io/uploads/S1-1mNlzbl.png) ### Enumeration ![image-15](https://hackmd.io/uploads/r... pentesting Web-Exploitation RedTeam Pentest IredTeam AS-REP Roasting https://pzhat.id.vn/writeups/iredteam-as-rep-roasting https://pzhat.id.vn/writeups/iredteam-as-rep-roasting Tue, 16 Dec 2025 17:00:00 GMT # IredTeam AS-REP Roasting ### AS-REP là gì? AS-REP (viết tắt của Authentication Service Reply) là một thông điệp trong giao thức xác thực Kerberos. Đây ... RedTeam pentesting Pentest iredteam ServerSide Template Injection (SSTI) Lab https://pzhat.id.vn/writeups/ssti-lab https://pzhat.id.vn/writeups/ssti-lab Mon, 15 Dec 2025 17:00:00 GMT # ServerSide Template Injection (SSTI) Lab ### SSTI là gì Server-Side Template Injection (SSTI) là một lỗ hổng bảo mật web nghiêm trọng cho phép kẻ tấn cô... pentesting Web-Exploitation Web GraphQL API Vulnerability https://pzhat.id.vn/writeups/graphql-api-vulnerability https://pzhat.id.vn/writeups/graphql-api-vulnerability Sun, 14 Dec 2025 17:00:00 GMT # GraphQL API Vulnerability PortSwigger Challenge ### Overview về GraphQL GraphQL là một ngôn ngữ truy vấn cho API (Query Language for APIs) và cũng là mộ... pentesting Web-Exploitation Web PortSwigger PortSwigger CORS (Cross-Origin Resource Sharing) challenge WriteUp https://pzhat.id.vn/writeups/cors-portswigger https://pzhat.id.vn/writeups/cors-portswigger Sat, 13 Dec 2025 17:00:00 GMT # PortSwigger CORS (Cross-Origin Resource Sharing) challenge WriteUp ### Overview về CORS #### CORS là gì? Vì sao lại xuất hiện - CORS (Cross-Origin Reso... pentesting Web-Exploitation Web PortSwigger Ired.Team Kerberos Silver Ticket Execution https://pzhat.id.vn/writeups/i-redteam-kerberos-silver-ticket https://pzhat.id.vn/writeups/i-redteam-kerberos-silver-ticket Fri, 12 Dec 2025 17:00:00 GMT # Ired.Team Kerberos Silver Ticket Tiếp tục chuỗi series AD abuse thì tiếp theo ta tiến tới Kerberos Silver Ticket có nghĩa là ta sẽ hack quyền từ Kerberos n... RedTeam pentesting Pentest iredteam PortSwigger CSRF Challenge WriteUps https://pzhat.id.vn/writeups/csrf-portswigger-challenge https://pzhat.id.vn/writeups/csrf-portswigger-challenge Thu, 11 Dec 2025 17:00:00 GMT # PortSwigger CSRF Challenge WriteUp ### Giới thiệu về CSRF (Cross-Site Request Forgery) #### Lỗ hổng CSRF là gì : - Cross-Site Request Forgery hay còn... pentesting Web-Exploitation Web PortSwigger Ysoserial Commons Collections 5 Analyst https://pzhat.id.vn/research/ysoserial-cc5 https://pzhat.id.vn/research/ysoserial-cc5 Wed, 10 Dec 2025 17:00:00 GMT # Ysoserial Commons Collections 5 Analyst ### Tổng quan CommonsCollections 5 trong Ysoserial CommonsCollections là một trong những gadget chain nổi tiếng ... pentesting Web-Exploitation Web ysoserial Ired.Team Kerberos Golden Tickets Lab https://pzhat.id.vn/writeups/i-redteam-kerberos-golden-ticket https://pzhat.id.vn/writeups/i-redteam-kerberos-golden-ticket Tue, 09 Dec 2025 17:00:00 GMT # Ired.Team Kerberos: Golden Tickets Lab ### Overview Lab này khám phá một cuộc tấn công vào Kerberos Authentication của Active Directory(AD). Chính xác hơn... RedTeam pentesting Pentest iredteam Tryhackme Basic Pentesting Challenge https://pzhat.id.vn/writeups/thm-basic-pentesting https://pzhat.id.vn/writeups/thm-basic-pentesting Mon, 08 Dec 2025 17:00:00 GMT # Tryhackme Basic Pentesting Challenge ![image](https://hackmd.io/uploads/BkgEBzP1Zx.png) Sử dụng nmap để scan các port đang mở của target ở đây tôi sử dụ... pentesting RedTeam Pentest Ired.Team Kerberoasting (Credential Access) https://pzhat.id.vn/writeups/i-redteam-kerberoasting https://pzhat.id.vn/writeups/i-redteam-kerberoasting Sun, 07 Dec 2025 17:00:00 GMT # Ired.Team Kerberoasting (Credential Access) ### Giải thích về các khái niệm #### Kerberos trong Active Directory - Trong môi trường Windows Active Di... RedTeam pentesting Pentest iredteam Ired.Team From Domain Admin to Enterprise Admin https://pzhat.id.vn/writeups/iredteam-from-da-to-ea https://pzhat.id.vn/writeups/iredteam-from-da-to-ea Sat, 06 Dec 2025 17:00:00 GMT # Ired.Team From Domain Admin to Enterprise Admin ### Overview Ở lab này ta sẽ lợi dụng mối quan hệ giữa Parent-Child domain từ đó lợi dụng mối quan hệ đ... RedTeam pentesting Pentest iredteam Java Deserialze - URLDNS Chain analysis (ysoserial) https://pzhat.id.vn/research/ysoserial-urldns https://pzhat.id.vn/research/ysoserial-urldns Fri, 05 Dec 2025 17:00:00 GMT # Java Deserialze - URLDNS Chain analysis (ysoserial) ![image](https://hackmd.io/uploads/r1R3sp6Rgl.png) ### Java Deserialize là gì? - Java cung cấp ch... pentesting Web-Exploitation ysoserial Web Spring Time CTF challenge WriteUp https://pzhat.id.vn/writeups/cscv-spring-time-challenge https://pzhat.id.vn/writeups/cscv-spring-time-challenge Thu, 04 Dec 2025 17:00:00 GMT # Spring Time CTF challenge WriteUp ![image](https://hackmd.io/uploads/r14Z7wRgx.png) Web App được chia làm 2 services khác nhau bao gồm: - gateman : p... pentesting Web-Exploitation CTF Web Java Deserialize CBJS Lab https://pzhat.id.vn/writeups/cbjs-java-deserialize https://pzhat.id.vn/writeups/cbjs-java-deserialize Wed, 03 Dec 2025 17:00:00 GMT # Java Deserialize CBJS Lab ### Giải thích chi tiết về lỗ hổng Deserialization 1. Deserialization là gì? - Serialization là quá trình chuyển đổi một obj... pentesting Web-Exploitation CTF Web Pentester Lab From Sql Injection to Shell https://pzhat.id.vn/writeups/pentesterlab-from-sql-to-shell https://pzhat.id.vn/writeups/pentesterlab-from-sql-to-shell Tue, 02 Dec 2025 17:00:00 GMT # Pentester Lab From Sql Injection to Shell ### Fingerprinting ![image](https://hackmd.io/uploads/SyqcWYLTeg.png) Sử dụng nmap với cú pháp: shell s... pentesting Web-Exploitation RedTeam Pentest Web Cache Deception Demo Lab https://pzhat.id.vn/writeups/web-cache-deception https://pzhat.id.vn/writeups/web-cache-deception Mon, 01 Dec 2025 17:00:00 GMT # Web Cache Deception Demo Lab ### Tổng quan Web Cache Deception Lỗ hổng "web cache deception" (đánh lừa bộ nhớ đệm web) là một dạng lỗ hổng bảo mật web,... pentesting Web-Exploitation Web NoSQL Injection Vulnerability Challenge Java https://pzhat.id.vn/writeups/nosql-injection-lab https://pzhat.id.vn/writeups/nosql-injection-lab Sun, 30 Nov 2025 17:00:00 GMT # NoSQL Injection Vulnerability Challenge Java ### Tổng quan về NoSQL Injection - Tấn công NoSQL injection là một lỗ hổng bảo mật trong các ứng dụng web s... pentesting Web-Exploitation Web Broken Access Control Vulnerability Lab https://pzhat.id.vn/writeups/brokenaccess-control https://pzhat.id.vn/writeups/brokenaccess-control Sat, 29 Nov 2025 17:00:00 GMT # Broken Access Control Vulnerability Lab ### What is Broken Access Control (BAC) Broken Access Control là một loại lỗ hổng bảo mật web xảy ra khi người d... pentesting Web-Exploitation Web XXE Injection Vulnerability Lab https://pzhat.id.vn/writeups/xxe-injection https://pzhat.id.vn/writeups/xxe-injection Fri, 28 Nov 2025 17:00:00 GMT # XXE Injection Vulnerability Lab ### XXE Injection là gì? XXE (XML External Entity) Injection là một lỗ hổng bảo mật web cho phép kẻ tấn công can thiệp v... pentesting Web-Exploitation Web WebSec.fr level 1 CTF challenge https://pzhat.id.vn/writeups/websecfr-level1 https://pzhat.id.vn/writeups/websecfr-level1 Thu, 27 Nov 2025 17:00:00 GMT # WebSec.fr level 1 CTF challenge ### Overview ![image](https://hackmd.io/uploads/Sk1nSnX3xg.png) Giao diện chức năng của level này ta có thể thấy nó l... pentesting Web-Exploitation CTF Web Server Side Request Forgery (Java) https://pzhat.id.vn/writeups/ssrf-challenge https://pzhat.id.vn/writeups/ssrf-challenge Wed, 26 Nov 2025 17:00:00 GMT # Server Side Request Forgery (Java) ### Source Code Github: https://github.com/pzhat/SSRFvulndemo ### What is SSRF Giới thiệu về Server-Side Reque... pentesting Web-Exploitation Web Java Servlet Path Traversal vulnerability https://pzhat.id.vn/writeups/path-traversal-servlet https://pzhat.id.vn/writeups/path-traversal-servlet Tue, 25 Nov 2025 17:00:00 GMT # Java Servlet Path Traversal vulnerability ### Source Code: [[Github Link](https://github.com/pzhat/PathTraversalLab)] ### Overview ![image](https:... pentesting Web-Exploitation Web CyberCon 2025 SafeUpload Web Challenge https://pzhat.id.vn/writeups/seccon-safeupload-web-challenge https://pzhat.id.vn/writeups/seccon-safeupload-web-challenge Mon, 24 Nov 2025 17:00:00 GMT # CyberCon 2025 SafeUpload Web Challenge ### Tổng quan challenge ![image](https://hackmd.io/uploads/Hkm8uTIjll.png) Mở challenge lên thì ta thấy nó cấ... pentesting Web-Exploitation CTF Web WebSec.fr Level 28 CTF challenge https://pzhat.id.vn/writeups/websec-fr-level28 https://pzhat.id.vn/writeups/websec-fr-level28 Sun, 23 Nov 2025 17:00:00 GMT # WebSec.fr Level 28 CTF challenge ### Tổng quan: ![image](https://hackmd.io/uploads/Syc1KLLjxl.png) php <?php if(isset($POST['submit'])) { if ($F... pentesting Web-Exploitation CTF Web Tryhackme EvilGPT challenge WriteUp by @phatmh https://pzhat.id.vn/writeups/thm-evilgpt https://pzhat.id.vn/writeups/thm-evilgpt Sat, 22 Nov 2025 17:00:00 GMT # Tryhackme EvilGPT challenge WriteUp by @phatmh ![image](https://hackmd.io/uploads/SJs0f-gLgl.png) ![image](https://hackmd.io/uploads/BJbzEWeIle.png) Dùng... pentesting RedTeam Pentest Java Servlet Sql Injection Vulnerability by @Phatmh https://pzhat.id.vn/writeups/servlet-sql-injection https://pzhat.id.vn/writeups/servlet-sql-injection Fri, 21 Nov 2025 17:00:00 GMT # Java Servlet Sql Injection Vulnerability by @Phatmh ### Tổng quan cấu trúc file java +---.idea +---dataSources +---.mvn +---wrapper +---... pentesting Web-Exploitation Web Java Servlet Command Injection Vulnerability Challenges https://pzhat.id.vn/writeups/servlet-cmdi https://pzhat.id.vn/writeups/servlet-cmdi Thu, 20 Nov 2025 17:00:00 GMT # Java Servlet Command Injection Vulnerability Challenges ### Cấu trúc Project <summary> Cấu trúc Project </summary> text +---.idea +---.mvn ª +... pentesting Web-Exploitation Web TryHackme Pickle Rick Challenge WriteUp by Phatmh. https://pzhat.id.vn/writeups/pickle-rick-thm https://pzhat.id.vn/writeups/pickle-rick-thm Wed, 19 Nov 2025 17:00:00 GMT # TryHackme Pickle Rick Challenge WriteUp by Phatmh. ![image](https://hackmd.io/uploads/HyFRp7ONel.png) [link challenge]:https://tryhackme.com/room/picklerick... pentesting RedTeam Pentest Java Servlet FileUpload Vulnerability https://pzhat.id.vn/writeups/fileupload-servlet https://pzhat.id.vn/writeups/fileupload-servlet Tue, 18 Nov 2025 17:00:00 GMT # Java Servlet FileUpload Vulnerability by @Phatmh ### Lỗ hổng File Upload Bản chất của File Upload: File Upload đối với tôi nó đơn giản chỉ là lợi dụng ... pentesting Web-Exploitation Web Cookie Arena Challenges WU (@Phatmh) https://pzhat.id.vn/writeups/cookie-arena-cmdi https://pzhat.id.vn/writeups/cookie-arena-cmdi Mon, 17 Nov 2025 17:00:00 GMT # Cookie Arena Web Challenges WriteUp by (@Phatmh) ### NSLookup (Level 1) Đây là một Website có chức năng là nslookup sử dụng hàm shellexec của php để thực ... pentesting Web-Exploitation CTF Web CanteenFood CTF Challenge WriteUp https://pzhat.id.vn/writeups/canteenfood-ctf-challenge-writeup https://pzhat.id.vn/writeups/canteenfood-ctf-challenge-writeup Sun, 16 Nov 2025 17:00:00 GMT # CanteenFood CTF Challenge WriteUp by @Phatmh ## Tiến hành phân tích chức năng theo kiểu BlackBox ![image](https://hackmd.io/uploads/SJOQlrxHxx.png) Đây... pentesting Web-Exploitation CTF Web