Bipin Jitiya win3zz

CVE-2026-38165 - Proof of Concept

CVE-2026-38165 is a Server-Side Template Injection vulnerability in XDocReport's Velocity integration, affecting versions up to 2.1.0 when untrusted DOCX templates are processed. The vulnerable processing path uses Apache Velocity's velocityEngine.evaluate() to evaluate template content during report.process(). If an application accepts attacker-controlled DOCX templates and renders them without adequate isolation or template restrictions, injected Velocity expressions can access Java classes and invoke sensitive functionality, resulting in server-side command execution. The issue is particularly relevant to document management, HR, reporting and content generation applications that allow template uploads.

From an exploitation perspective, the impact is equivalent to arbitrary code execution within the privileges of the Java process, with potential access to application secrets, files, credentials and other internal resources. The primary security boundary is therefo

Stage 1 – Visit Upload Page (Get CSRF)

GET / HTTP/1.1
Host: victim.com

Response

This script creates a spreadsheet (packages.csv) listing every software package manually installed on a Linux system, along with its executable commands and a brief description.

echo 'Package,Commands,Description' > packages.csv

for pkg in $(apt-mark showmanual); do
    desc=$(dpkg-query -W -f='${Description}' "$pkg" 2>/dev/null | head -n1)

    cmds=$(dpkg -L "$pkg" 2>/dev/null \
 | grep -E '/bin/' \

Manus ApiProxyService CallApi Endpoint Information

Overview

The https://api.manus.im/apiproxy.v1.ApiProxyService/CallApi endpoint is a central proxy service used by Manus to route requests to internal sandbox services. It acts as an intermediary that handles authentication, routing, and access control.

Request Structure

The endpoint accepts a POST request with a JSON body.

Headers

x-sandbox-token: Required. The API token for authentication (usually found in $HOME/.secrets/sandbox_api_token).

Goal: Quickly locate GitHub Actions workflow exposures / misconfigs inside a specific Bug Bounty program org (GitHub search, code search, and dorks). Assume target org: ORG_NAME.

1. Find All Workflows in Target Org

org:ORG_NAME path:.github/workflows language:YAML

This technical brief details the implementation of a Cgroup v2 eBPF device controller bypass. This method leverages the bpf() system call to detach the security programs governing device access.

Technical Implementation

1. Identify Target Cgroup

First, locate the specific Cgroup v2 mount point for the current process. This is the filesystem target from which we will detach the eBPF programs.

Google Cloud Shell Takeover: 3 Auto Execution Bugs

A few weeks ago, I came across an interesting security vulnerability inside Google Cloud Shell. While analyzing how Cloud Shell Editor (Code OSS) loads projects, I observed that simply opening a specially crafted project within the editor triggers silent and automatic code execution. The user doesn't need to type any commands, or run any tasks manually. Simply open the project and the payload will be executed.

The root cause was that many components/processes executes inside the Cloud Shell Editor during workspace load. Tools like the Gradle language server, the Clang language server, and the VS Code tasks system evaluate config files or build scripts as soon as the folder is opened. This seems simple in a normal development workflow, but it breaks a very basic assumption/principle we all rely on: cloning a repo or opening a project in an editor will never execute a command without user action.

I understood this behavior, the attack scenario was

Weird, surprising, sometimes scary language/parser/compiler quirks across major programming languages.

1. Unicode Escape Shenanigans

Language	Example	What Happens	Impact
Java	`// \u000d System.out.println("exec");`	Unicode processed before comment → newline injected → code runs	Comment-bypass, hidden payload
JS/TS	`var a\uFF0Eb = 1;`	Fullwidth dot makes variable look like `a.b`	Identifier spoofing
Python	`print("x")` (EN QUAD)	Invisible indentation → syntax changes	Hidden code flow
Go/Rust	`var рassword` (Cyrillic р)	Identifiers look identi

	Useful for Shell scripts, BusyBox applets, ELF binaries, CGI binaries, Init scripts, IPC handlers, Configuration parsers etc
	---

	# --- TIME-BASED BLIND DETECTION ---
	;sleep 10;
	\|sleep 10\|
	&sleep 10&
	\nsleep 10\n
	`sleep 10`
	$(sleep 10)

	AI kernel
	=========

	AI is like a mirror. A mirror does not show only our
	best angles; it also shows the "dust" on the lens.

	Artificial intelligence reflects human intelligence.
	If human thinking contains flaws, errors, greed, or
	biases, AI will inevitably reflect them as well.