By: savi0r  Date: November 2025  Duration: ~3 hours  Result: Full Solve (JWT Admin Takeover → SSTI → RCE → Flag)  Status: ✅ Completed

This blog post explores a bug, (CVE-2025-64755), I found while trying to find a command execution primitive within Claude Code to demonstrate the risks of web-hosted MCP to a client.

At Intigriti, we host monthly web-based Capture The Flag (CTF) challenges as a way to engage with the security research community. This month, we've decided to take on a challenge ourselves as a way t...

We are thrilled to announce the launch of the Sonar Integration Program. This strategic initiative formalizes and expands our partner ecosystem, unifying SonarQube's integrations with leading technology partners under a single, comprehensive program.

Introduction

This blog serves as a detailed methodology guide for analyzing, reversing, and researching web vulnerabilities, particularly those with CVEs assigned. The content outlines repeatable processes used to evaluate vague advisories, analyze vulnerable…

Hello Security Researchers & Bug Bounty Community,

We are thrilled to announce the launch of the Sonar Integration Program. This strategic initiative formalizes and expands our partner ecosystem, unifying SonarQube's integrations with leading technology partners under a single, comprehensive program.

Hey there, security enthusiasts and fellow hackers! 🙂‍↔️

Enhance compliance and security with the new audit logs for SonarQube Cloud Enterprise plan. Get a chronological record of key IAM events, accessible via API to integrate with your SIEM tools.

Dive into $100K+ cache poisoning vulnerabilities. Part 1 covers real-world attacks on HackerOne, GitHub, and Shopify. Read the analysis!

Summary of Releases v10.3.2 & v10.3.4

This month, we had two releases of Nuclei Templates, introducing numerous improvements and new templates for Nuclei users.


🚀 November Stats






Release
New Templates Added
CVEs Added
First-time Contributors
Bounties…

Learn how to identify and hunt for Content Security Policy (CSP) bypasses using multiple testing methods. Read the article now!

SonarQube has emerged as a leading automated code review platform that empowers development teams to achieve a high level of code quality and code security.

How Intigriti uses the implementation of AI to solve three key business challenges relating to vulnerability submissions.

Trail of Bits developed constant-time coding support for LLVM that prevents compilers from breaking cryptographic implementations vulnerable to timing attacks, introducing the __builtin_ct_select family of intrinsics that preserve constant-time properties…

Neo is a cloud-based AI security engineer that works alongside your team and takes on real security tasks like a true co-engineer. As it operates, it continuously learns your systems and processes, improving over time just like an engineer ramping up on your…

Enhance compliance and security with the new audit logs for SonarQube Cloud Enterprise plan. Get a chronological record of key IAM events, accessible via API to integrate with your SIEM tools.

We are excited to announce a new release of our Burp Suite Extension - InQL v6.1.0! The complete re-write from Jython to Kotlin in our previous update (v6.0.0) laid the groundwork for us to start implementing powerful new features, and this update delivers…