Research Projects

2026

Craft CMS 🧱

Craft CMS 0day research (5 findings, 3 CVEs), from unauthenticated RCE through GraphQL and a database outage to signed-cookie Twig injection and blind SQL injection.

• 💻 PoCs: craftcms-2026-pocs
• 📝 Blog posts:
  • CVE-2026-92592: Craft CMS Authenticated RCE via Signed-Cookie Redirect Confusion
  • CVE-2026-92591: Craft CMS Environment Disclosure to Unauthenticated RCE via Database Fail-Open
  • CVE-2026-79987: Craft CMS Unauthenticated RCE via GraphQL Eager-Load Injection
  • Craft CMS Unauthenticated SQL Injection via GraphQL Eager-Load Criteria

Frappe and ERPNext 🧾

Frappe Framework and ERPNext 0day research (7 findings, 2 critical advisories), from guest stored XSS and file disclosure to authorisation bypasses, CSRF and RCE.

• 💻 PoCs: frappe-erpnext-2026-pocs
• 📝 Blog posts:
  • Guest Stored XSS and Safe-Jinja File Write to RCE in Frappe and ERPNext
  • CVE-2026-109601: Frappe Unauthenticated Email Inline-Embed File Disclosure
  • Frappe Web Form Publication and Field Authorisation Failures
  • Frappe Bulk Update GET CSRF and a Browser-to-RCE Chain

Signed, Sealed, Compromised: Weaponizing Enterprise Mail Infrastructure 💌

Zimbra 0day research (80+ CVEs), some of which were presented at BruCON 0x12.

• 🎥 Talk: BruCON 0x12
• 💻 Technical analysis, PoCs & screenshots: zimbra-vulnerability-tracker
• 📝 Blog posts: From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1) — part 1 of 4, more coming soon™
• 🛠️ Metasploit modules: coming soon™

---

Check out my academic work 📚 and research at Rapid7 Intelligence 🧡