Voorivex Team — security research & pentest writeups https://blog.voorivex.team Original vulnerability research, pentest writeups, and tooling notes from the Voorivex team. en-US Sat, 18 Jul 2026 12:26:03 +0000 Voorivex blog generator JavaScript Functions Overload Confusion https://blog.voorivex.team/javascript-functions-overload-confusion https://blog.voorivex.team/javascript-functions-overload-confusion Wed, 15 Jul 2026 00:00:00 +0000 Yashar Shahinzadeh postmessage xss dom-xss Content-Type Override to Stored XSS on Public Objects https://blog.voorivex.team/content-type-override-to-stored-xss-on-public-objects https://blog.voorivex.team/content-type-override-to-stored-xss-on-public-objects Tue, 30 Jun 2026 00:00:00 +0000 Amirmohammad Safari content-type stored-xss minio s3 file-upload cloud-storage The Usual Suspect: Type Confusion in Twelve Bytes https://blog.voorivex.team/usual-suspect-type-confusion-in-twelve-bytes https://blog.voorivex.team/usual-suspect-type-confusion-in-twelve-bytes Wed, 17 Jun 2026 00:00:00 +0000 HamidSj type-confusion file-type cspt polyglot file-upload Three 0-Day Vulnerabilities in Adminer https://blog.voorivex.team/three-0-day-vulnerabilities-in-adminer https://blog.voorivex.team/three-0-day-vulnerabilities-in-adminer Tue, 09 Jun 2026 00:00:00 +0000 Yashar Shahinzadeh, Amirmohammad Safari adminer php rce xss 0-day web My First RCE by Reverse Engineering an EXE File With the Help of AI https://blog.voorivex.team/first-rce-via-reverse-engineering-with-ai https://blog.voorivex.team/first-rce-via-reverse-engineering-with-ai Wed, 03 Jun 2026 00:00:00 +0000 Yashar Shahinzadeh rce reverse-engineering ai dotnet pentest cswsh Two cPanel Zero Day Vulnerabilities https://blog.voorivex.team/two-cpanel-zero-day-vulnerabilities https://blog.voorivex.team/two-cpanel-zero-day-vulnerabilities Tue, 19 May 2026 00:00:00 +0000 Yashar Shahinzadeh, Amirmohammad Safari cpanel mailman xss 0-day web We Need to Talk About CSRF Again https://blog.voorivex.team/we-need-to-talk-about-csrf-again https://blog.voorivex.team/we-need-to-talk-about-csrf-again Fri, 08 May 2026 00:00:00 +0000 Amirmohammad Safari csrf content-type chromium apollo xs-leak fastapi Story of Abusing a Fully Secured redirect_uri in an OAuth Flow https://blog.voorivex.team/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow https://blog.voorivex.team/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow Sat, 21 Mar 2026 00:00:00 +0000 Yashar Shahinzadeh oauth redirect_uri auth uXSS on Samsung Browser [CVE-2025-58485 · SVE-2025-1879] https://blog.voorivex.team/uxss-on-samsung-browser-cve-2025-58485-sve-2025-1879 https://blog.voorivex.team/uxss-on-samsung-browser-cve-2025-58485-sve-2025-1879 Mon, 23 Feb 2026 00:00:00 +0000 Omid Rezaei, Yashar Shahinzadeh android uxss browser cve When Two Parsers Disagree: Exploiting Query String Differentials for XSS https://blog.voorivex.team/when-two-parsers-disagree-exploiting-query-string-differentials-for-xss https://blog.voorivex.team/when-two-parsers-disagree-exploiting-query-string-differentials-for-xss Tue, 10 Feb 2026 00:00:00 +0000 Amirmohammad Safari xss parser-differential express oauth Shaking the MCP Tree: a security deep dive https://blog.voorivex.team/shaking-the-mcp-tree https://blog.voorivex.team/shaking-the-mcp-tree Tue, 03 Feb 2026 00:00:00 +0000 Amirmohammad Safari mcp oauth ssrf xss DOM XSS to Account Takeover: not-so-dirty dancing in a GIS SDK https://blog.voorivex.team/not-so-dirty-dancing-in-gis-sdk https://blog.voorivex.team/not-so-dirty-dancing-in-gis-sdk Sun, 07 Dec 2025 00:00:00 +0000 HamidSj dom-xss oauth gis account-takeover Cloudflare Image Proxy as a CSPT Gadget: A Cross-Origin CSPT Exploit https://blog.voorivex.team/cloudflare-image-proxy-as-a-cspt-gadget-a-cross-origin-cspt-exploit https://blog.voorivex.team/cloudflare-image-proxy-as-a-cspt-gadget-a-cross-origin-cspt-exploit Sun, 19 Oct 2025 00:00:00 +0000 Amirmohammad Safari cspt cloudflare redirect cross-origin Hacking Veeam: Several CVEs and $30k Bounties https://blog.voorivex.team/hacking-veeam-several-cves-and-30k-bounties https://blog.voorivex.team/hacking-veeam-several-cves-and-30k-bounties Sat, 09 Aug 2025 00:00:00 +0000 Yashar Shahinzadeh cve veeam rce ntlm Puny-Code, 0-Click Account Takeover https://blog.voorivex.team/puny-code-0-click-account-takeover https://blog.voorivex.team/puny-code-0-click-account-takeover Sun, 01 Jun 2025 00:00:00 +0000 Yashar Shahinzadeh, Amirmohammad Safari puny-code account-takeover parser-differential oauth Stealing oAuth Token via Referrer Policy Override https://blog.voorivex.team/leaking-oauth-token-via-referrer-leakage https://blog.voorivex.team/leaking-oauth-token-via-referrer-leakage Tue, 06 May 2025 00:00:00 +0000 Omid Rezaei oauth referrer chrome token-theft CSS Data Exfiltration to Steal OAuth Token https://blog.voorivex.team/css-data-exfiltration-to-steal-oauth-token https://blog.voorivex.team/css-data-exfiltration-to-steal-oauth-token Sat, 15 Feb 2025 00:00:00 +0000 Amirmohammad Safari, Yashar Shahinzadeh css-exfiltration oauth dompurify html-injection OAuth Non-Happy Path to ATO https://blog.voorivex.team/oauth-non-happy-path-to-ato https://blog.voorivex.team/oauth-non-happy-path-to-ato Fri, 22 Nov 2024 00:00:00 +0000 Omid Rezaei oauth account-takeover non-happy-path referer From an Android Hook to RCE: $5000 Bounty https://blog.voorivex.team/from-an-android-hook-to-rce-5000-bounty https://blog.voorivex.team/from-an-android-hook-to-rce-5000-bounty Tue, 19 Nov 2024 00:00:00 +0000 Yashar Shahinzadeh android rce mobile bug-bounty A Weird CSP Bypass led to $3.5k Bounty https://blog.voorivex.team/a-weird-csp-bypass-led-to-35k-bounty https://blog.voorivex.team/a-weird-csp-bypass-led-to-35k-bounty Wed, 23 Oct 2024 00:00:00 +0000 Omid Rezaei, Yashar Shahinzadeh csp xss browser bug-bounty Drilling the redirect_uri in OAuth https://blog.voorivex.team/drilling-the-redirecturi-in-oauth https://blog.voorivex.team/drilling-the-redirecturi-in-oauth Fri, 11 Oct 2024 00:00:00 +0000 Yashar Shahinzadeh oauth redirect_uri auth Account Takeover due to DNS Rebinding https://blog.voorivex.team/account-takeover-due-to-dns-rebinding https://blog.voorivex.team/account-takeover-due-to-dns-rebinding Tue, 17 Sep 2024 00:00:00 +0000 Yashar Shahinzadeh dns-rebinding account-takeover sso $20,300 Bounties from a 200 Hour Hacking Challenge https://blog.voorivex.team/20300-bounties-from-a-200-hour-hacking-challenge https://blog.voorivex.team/20300-bounties-from-a-200-hour-hacking-challenge Tue, 05 Mar 2024 00:00:00 +0000 bug-bounty challenge methodology Hijacking OAuth Code via Reverse Proxy for Account Takeover https://blog.voorivex.team/hijacking-oauth-code-via-reverse-proxy-for-account-takeover https://blog.voorivex.team/hijacking-oauth-code-via-reverse-proxy-for-account-takeover Fri, 17 Nov 2023 00:00:00 +0000 Omid Rezaei oauth account-takeover reverse-proxy $7000 Bounty on a Single Web Application https://blog.voorivex.team/7000-bounty-on-a-single-web-application https://blog.voorivex.team/7000-bounty-on-a-single-web-application Wed, 01 Nov 2023 00:00:00 +0000 bug-bounty web writeup $9240 Bounty in 30 days Hunt Challenge https://blog.voorivex.team/9240-bounty-in-30-days-hunt-challenge https://blog.voorivex.team/9240-bounty-in-30-days-hunt-challenge Sat, 21 Oct 2023 00:00:00 +0000 Omid Rezaei bug-bounty challenge methodology Bug Bounty Roadmap from Scratch https://blog.voorivex.team/bug-bounty-roadmap-from-scratch https://blog.voorivex.team/bug-bounty-roadmap-from-scratch Fri, 20 Oct 2023 00:00:00 +0000 Yashar Shahinzadeh methodology bug-bounty beginners Uncovering a Command Injection, $2400 Bounty https://blog.voorivex.team/uncovering-a-command-injection-2400-bounty https://blog.voorivex.team/uncovering-a-command-injection-2400-bounty Sat, 14 Oct 2023 00:00:00 +0000 Omid Rezaei command-injection rce web