blog — research

What I find, I write up

CVE analyses, OWASP methodologies and pentesting fundamentals — from a practitioner's perspective.

CVE · SQLi12 min

CVE-2026-33944 — SQL Injection in Dolibarr ERP/CRM

The localtax1_value parameter reaches an UPDATE query without sanitisation — full database exfiltration.

read →
CVE · XSS8 min

CVE-2022-1438 — Persistent XSS in Keycloak

Missing server-side validation of the username field enables XSS during impersonation.

read →
OWASP ASVS8 min

The OWASP ASVS methodology in web application testing

Three verification levels, practical examples and a case study from real pentests.

read →
OWASP Top 108 min

OWASP Top 10 2025 — new threats

How the new threat categories will affect application testing methodologies.

read →
Basics6 min

What is penetration testing?

Types of pentests (black/grey/white-box) and why they are essential.

read →
Social engineering · AI6 min

AI phishing — how AI is reshaping the threat

Deepfakes, personalised attacks and the role of phishing campaigns in defence.

read →