Cymetrics Tech Blog

ERPNext is a very popular open-source ERP(Enterprise Resource Planning) software built on Frappe Framework.Last December, we found two vulnerabilities in the latest version of ERPNext: SSRF(Server-Side Request Forgery) and account takeover via XSS. Both vulnerabilities require a low-privileged authenticated user to perform the attack.

Last year, a critical vulnerability in the Java ecosystem named Log4Shell has been found, it is described as a "nuclear bomb-level loophole".Recently, another critical vulnerability has been found in Spring core, because of its similarity to Log4Shell, it's named "Spring4shell".

Amelia is a WordPress plugin for booking systems developed by TNS. With 40,000+ active installations, it has been used for the clinic, hair salon, tutor, and so on.In March, we studied the source code of Amelia and found three vulnerabilities in the end

“Why do you want me to reset my password instead of sending me the old password?”Many people might have the similar doubts like John. Wouldn't it be nice to send me the old password? Why force me to change it?

The break of dawn on a August morning marked the end of my OSCP journey as I waved goodbye to my proctor and finally uploaded the exam report. Half a year ago, I wouldn't have dreamt of obtaining the OSCP, but now with the beast tamed and the struggle over, let me share my (fortunately) fruitful journey with you.

In July 2021, we found 4 vulnerabilities in Glints. If a malicious actor exploits the vulnerabilities, they could have stolen your resume.

We're all too used to exploiting web applications to hijack someone else's website and post our own stuff, but did you know that there's a much easier way to take over a site? To discuss the much overlooked topic of DNS security, first we have to go over the basics of how the DNS functions and what DNS records are.

Cache is one of the most important parts of the backend. We always use cache to improve latency. There are several things worth thinking about more before we implement cache architecture. In this article, I want to briefly discuss some of that.