window.namePersonal security-research blog by David Vieira-Kurzhttps://window.name/2026-10-13T11:29:31ZDavid Vieira-KurzWrite-up: Stored XSS in TinyMCE via media plugin data-mce-object serialization (High, GHSA-mf2p-h6hf-fcwm)https://window.name/posts/tinymce-media-plugin-xss-data-mce-html.html2026-10-13T12:00:00ZIn short. The TinyMCE media plugin builds a preview element by assigning attacker-controlled data-mce-html to innerHTML on a live element, and it does this before the sanitizer runs. An <img onerror=...> placed in…Write-up: Stored XSS in the Jodit editor via a cleanHTML sanitizer bypass (GHSA-jhhp-r3r7-v2cg)https://window.name/posts/jodit-stored-xss-clean-html-bypass.html2026-10-10T12:00:00ZSummary. Jodit, a widely used open-source WYSIWYG editor, shipped a clean-html sanitizer whose asynchronous background pass did not honour the cleanHTML.removeEventAttributes setting. On that path the sanitizer…Write-up: Stored XSS in phpMyFAQ via an html_entity_decode() sanitizer bypass (High, SA-2026-10-03)https://window.name/posts/phpmyfaq-stored-xss-html-entity-decode-bypass.html2026-10-04T12:00:00ZIn short. phpMyFAQ sanitized a guest-submitted FAQ answer by encoding the dangerous characters and then, on the very next line, decoded them again with nothing to clean up afterwards. The raw markup is stored and runs…Write-up: Pre-authentication username enumeration in Keycloak via a login timing side-channelhttps://window.name/posts/keycloak-user-enumeration-timing-side-channel.html2026-08-08T12:00:00ZIn short. Keycloak 26.6.1 shows the same "Invalid username or password" message whether or not an account exists, yet it answers a valid username noticeably faster than one that does not. That timing gap alone lets an…Write-up: Access-control bypass to Slack's mission controlhttps://window.name/posts/slack-bug-bounty-journey.html2016-10-20T12:00:00ZSummary. During a black-box test under the Slack bug bounty program, an access-control filter in front of the Apache mod_status handler could be bypassed by prefixing the path with several forward slashes. The filter…Write-up: Remote code execution in Spring Security OAuth (CVE-2016-4977)https://window.name/posts/cve-2016-4977-spring-security-oauth-rce.html2016-10-13T12:00:00ZSummary. Spring Security OAuth shipped a default Whitelabel Error Page that evaluated user-controlled input as a Spring Expression Language (SpEL) expression. An unauthenticated attacker could turn a single crafted…Write-up: Source-code disclosure via an SOH byte in Tomcat routinghttps://window.name/posts/source-code-leak-using-soh.html2016-03-27T12:00:00ZSummary. A target running Apache httpd in front of Apache Tomcat could be tricked into disclosing the source of server-side files. By appending the SOH control character (start of heading, 0x01 ) to a.jsp or.inc URL…Write-up: From virtual assistant to remote code executionhttps://window.name/posts/from-va-2-rce.html2013-12-16T12:00:00ZSummary. During a black-box penetration test for a German financial institution, a customer-facing virtual assistant turned out to fetch a PHP file from a user-controlled URL and run the result through eval(). That made…Write-up: Remote code execution in eBay's search (preg_replace /e)https://window.name/posts/ebay-remote-code-execution.html2013-12-13T12:00:00ZSummary. eBay's search on sea.ebay.com ran query values through a server-side keyword filter that was built on preg_replace() with the /e modifier. That modifier evaluates the replacement as PHP, so a crafted value…Write-up: SQL injection in eBay's news.phphttps://window.name/posts/exploitable-sqli-on-ebay-dot-com-analysis.html2012-11-18T12:00:00ZSummary. A news endpoint on eBay's sea.ebay.com was vulnerable to error-based SQL injection through the checkbox array POST parameter. User input was concatenated into the SQL statement, which allowed extracting data…Write-up: Reflected XSS across Red Hat subdomainshttps://window.name/posts/xss-on-redhat-dot-com-analytics-script.html2012-11-17T12:00:00ZSummary. An Omniture analytics script deployed across *.redhat.com built its page-name variable from window.location and wrote it into an inline script block without escaping. A path crafted to close the string and open…Write-up: Reflected XSS in SAP.com's tracking scripthttps://window.name/posts/xss-on-sap-dot-com-analysis.html2012-11-11T12:00:00ZSummary. SAP's main website used a client-side tracking script, trackinghelper.js, that read values from window.location and wrote them into the page without escaping. A server-side filter blocked the obvious payloads…Write-up: Origin confusion in Firefox via data: URL redirectshttps://window.name/posts/window-dot-location-dot-assign-flaw-in-firefox-15-dot-0-1.html2012-10-08T12:00:00ZSummary. Firefox 15.0.1 handled window.location.assign() with a data: URL differently from WebKit browsers and Internet Explorer. After assigning a data: location that had been reached through a redirect…Write-up: DOM-based XSS and open redirect on Twitter.comhttps://window.name/posts/xss-via-hashtag-on-twitter-dot-com.html2012-10-07T12:00:00ZSummary. A client-side redirect helper on twitter.com, twttr.griffin.redirectOnHash(), took the location hash and used it to navigate without validating the scheme. A hash beginning with #! followed by a javascript: URI…Write-up: Open redirect to XSS in PayPal's profile formhttps://window.name/posts/paypal-dot-com-cancel-button-xss-analysis.html2012-10-07T12:00:00ZSummary. Two buttons on PayPal's developer profile form drove navigation from a returl parameter. The "cancel" button passed the value straight into location.href with no validation, giving open redirection and…Write-up: Address bar spoofing in Mobile Safari (CVE-2012-0674)https://window.name/posts/apple-safari-on-ios-5-dot-1-adressbar-spoofing-vulnerability.html2012-05-08T12:00:00ZSummary. Mobile Safari on iOS 5.1 (AppleWebKit/534.46) mishandled URLs opened with JavaScript's window.open(), so the address bar could show one URL while the content came from a different origin. That made convincing…Write-up: Session cookie exposure in the Apple Storehttps://window.name/posts/apple-store-xss-via-missing-frame-protection.html2012-01-19T12:00:00ZSummary. The Apple Store at store.apple.com was vulnerable to a cross-site scripting issue that allowed reading the session cookie and, as a result, acting in the context of another logged-in user. The absence of any…Write-up: Session hijacking in the Skype client via Facebook integrationhttps://window.name/posts/skype-client-remote-session-hijacking-over-facebook-integration.html2011-07-29T12:00:00ZSummary. A Facebook integration added to the Skype Windows client rendered content pulled from Facebook wall posts and comments inside the client without sanitizing it. A crafted wall comment was parsed and executed in…Write-up: Stored and reflected XSS in Google (VRP 2011)https://window.name/posts/google-bug-bounty-google-voice-xss.html2011-07-18T12:00:00ZSummary. Looking at Google's most widely used products in 2011, I found three cross-site scripting issues: a reflected XSS in the Google Voice calling-rate lookup, a stored XSS in Google Translate's file upload, and a…Write-up: Reflected XSS on DENIC.dehttps://window.name/posts/denic-de-xss-via-custom-parameter.html2011-07-08T12:00:00ZSummary. DENIC eG runs the central registry for the.de top-level domain. Its website at denic.de was vulnerable to reflected cross-site scripting through a parameter that was not part of the application's normal URL…Write-up: Script execution on Apple.com via an XML ATTLIST declarationhttps://window.name/posts/apple-dot-com-attlist-declaration-causing-script-execution.html2011-07-03T12:00:00ZSummary. A page on apple.com inserted user-generated content into an HTML comment through an XML parsing path that mishandled declarations. By injecting an XML ATTLIST declaration inside the DOCTYPE, with the right…Guidance: Reserved mailbox aliases that help prevent phishinghttps://window.name/posts/reserved-mailbox-aliases-prevent-phishing.html2011-06-15T12:00:00ZSummary. Platforms that let users self-register mail addresses or aliases often have no blocklist of reserved names, so anyone can claim support@, security@, info@ or no-reply@ on the domain. That makes low-noise…Guidance: Why every company needs a published security contacthttps://window.name/posts/security-contact-addresses-rfc2142.html2011-06-13T12:00:00ZSummary. Many organisations have no working way to receive a vulnerability report. The obvious addresses often bounce, and general contact forms rarely reach anyone who can act on a security issue. RFC 2142 has reserved…