corpus.blog
41554 blogs · [ { "id": "01a0d9e0-1ad3-716f-910f-7107ba29bb56", "title": "Part 2/6 | Breaking the Postgres Superuser Guardrails: Attacking Security-Hardening Extensions |Systemic Risks in the Managed PostgreSQL Industry", "url": "https://mehmetince.net/part-2-6-breaking-the-superuser-guardrails-attacking-security-hardening-extensions-systemic-risks-in-the-managed-postgresql-industry/", "published_at": "2026-09-23T01:05:18+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf941dc924a2", "title": "Part 1/6 | Systemic Risks in the Managed PostgreSQL Industry: Extension Risks Are Real! Exploiting PostGis Memory Corruption Bug at NeonDB, SupaBase and Many More", "url": "https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more/", "published_at": "2026-08-14T18:33:03+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf941df84901", "title": "The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Appliance", "url": "https://mehmetince.net/the-story-of-a-perfect-exploit-chain-six-bugs-that-looked-harmless-until-they-became-pre-auth-rce-in-a-security-appliance/", "published_at": "2026-01-01T09:46:58+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf941e7cac9b", "title": "Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain (ZDI-25-099, ZDI-25-097, ZDI-25-096)", "url": "https://mehmetince.net/inside-posthog-how-ssrf-a-clickhouse-sql-escaping-0day-and-default-postgresql-credentials-formed-an-rce-chain-zdi-25-099-zdi-25-097-zdi-25-096/", "published_at": "2025-12-15T11:48:49+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf941f495262", "title": "The Chessboard of Security: Insights on Product Development and Vulnerabilities from a Hacker Perspective", "url": "https://mehmetince.net/the-chessboard-of-security-insights-on-product-development-and-vulnerabilities-from-a-hacker-perspective/", "published_at": "2025-11-07T18:13:19+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf94202f167d", "title": "Digital Cosmos: A Journey Through the Galaxy of Vulnerabilities", "url": "https://mehmetince.net/digital-cosmos-a-journey-through-the-galaxy-of-vulnerabilities/", "published_at": "2025-10-07T18:09:36+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf9420cea77c", "title": "CVE-2021-3825 | LiderAhenk 0day – All your PARDUS Clients Belongs To Me", "url": "https://mehmetince.net/cve-2021-3825-liderahenk-0day-all-your-pardus-clients-belongs-to-me/", "published_at": "2021-12-21T08:06:01+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf9420d3c3c3", "title": "CVE-2021-3806 | Pardus 21 Linux Distro – Remote Code Execution 0day", "url": "https://mehmetince.net/pardus-21-linux-distro-remote-code-execution-0day-2021-cve-2021-3806/", "published_at": "2021-09-13T09:48:00+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf9421c1e43b", "title": "CVE-2021-21425 | Unexpected Journey #7 – GravCMS Unauthenticated Arbitrary YAML Write/Update leads to Code Execution", "url": "https://mehmetince.net/cve-2021-21425-unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/", "published_at": "2021-03-21T17:59:11+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf94221e9a4b", "title": "Vesta Control Panel Second Order Remote Code Execution 0day Step-by-Step Analysis", "url": "https://mehmetince.net/vesta-control-panel-second-order-remote-code-execution-0day-step-by-step-analysis/", "published_at": "2020-03-18T18:09:28+00:00" }, { "id": "01a087a3-b1da-724e-83d4-bf9423148c22", "title": "Why Secure Design Matters ? Secure Approach to Session Validation on Modern Frameworks (Django Solution)", "url": "https://mehmetince.net/why-secure-design-matters-secure-approach-to-session-validation-on-modern-frameworks-django-solution/", "published_at": "2019-09-08T06:12:13+00:00" }, { "id": "01a0bb92-82ac-73f6-bdfa-eb2df425a468", "title": "CVE-2018-20323 | MailCleaner Community Edition Remote Code Execution", "url": "https://mehmetince.net/cve-2018-20323-mailcleaner-community-edition-remote-code-execution/", "published_at": "2018-12-19T06:16:17+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa3520b5c60e", "title": "Unexpected Journey #6 – All ways lead to Rome ! Remote Code Execution on MicroFocus Secure Messaging Gateway", "url": "https://mehmetince.net/unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-messaging-gateway/", "published_at": "2018-06-22T06:23:58+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa3521a856b0", "title": "Advisory | ManageEngine Applications Manager Remote Code Execution and SQLi", "url": "https://mehmetince.net/advisory-manageengine-applications-manager-remote-code-execution-and-sqli/", "published_at": "2018-03-07T07:36:02+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa3521ac1cb9", "title": "CVE-2017-16666 | Xplico Unauthenticated Remote Code Execution", "url": "https://mehmetince.net/cve-2017-16666-xplico-unauthenticated-remote-code-execution/", "published_at": "2017-11-06T07:40:41+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa3521e44b04", "title": "One ring to rule them all – Same RCE on multiple Trend Micro products", "url": "https://mehmetince.net/one-ring-to-rule-them-all-same-rce-on-multiple-trend-micro-products/", "published_at": "2017-10-08T07:44:15+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa35223e43a0", "title": "Advisory | DenyAll Web Application Firewall Unauthenticated Remote Code Execution (CVE-2017-14706)", "url": "https://mehmetince.net/advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution-cve-2017-14706/", "published_at": "2017-09-19T17:00:01+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa3522a771bc", "title": "Advisory | osTicket v1.10 Unauthenticated SQL Injection (CVE-2017-14396 )", "url": "https://mehmetince.net/advisory-osticket-v1-10-unauthenticated-sql-injection-cve-2017-14396/", "published_at": "2017-09-12T17:03:04+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa3522eade5b", "title": "Exploiting Second Order SQLi Flaws by using Burp & Custom Sqlmap Tamper", "url": "https://mehmetince.net/exploiting-second-order-sqli-flaws-by-using-burp-custom-sqlmap-tamper/", "published_at": "2017-08-06T17:08:38+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa3523762f89", "title": "Unexpected Journey #5 – From weak password to RCE on Symantec Messaging Gateway (CVE-2017-6326)", "url": "https://mehmetince.net/unexpected-journey-5-from-weak-password-to-rce-on-symantec-messaging-gateway-cve-2017-6326/", "published_at": "2017-06-10T17:13:05+00:00" }, { "id": "01a0bb92-82ad-726f-bfe5-aa35241bcb38", "title": "Advisory | Cryptolog Unauthenticated Remote Code Execution", "url": "https://mehmetince.net/advisory-cryptolog-unauthenticated-remote-code-execution/", "published_at": "2017-05-17T17:18:47+00:00" }, { "id": "01a0bb9e-4a88-73c9-9fce-296f4fbf749b", "title": "Unexpected Journey #4 – Escaping from Restricted Shell and Gaining Root Access to SolarWinds Log & Event Manager (SIEM) Product", "url": "https://mehmetince.net/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/", "published_at": "2017-03-17T06:17:56+00:00" }, { "id": "01a0bb9e-4a88-73c9-9fce-296f506c7d3c", "title": "Unexpected Journey #3 – Visiting Another SIEM and Uncovering Pre-auth Privileged Remote Code Execution", "url": "https://mehmetince.net/unexpected-journey-3-visiting-another-siem-and-uncovering-pre-auth-privileged-remote-code-execution/", "published_at": "2017-03-07T06:21:18+00:00" }, { "id": "01a0bb9e-4a88-73c9-9fce-296f5153c0ed", "title": "Unexpected Journey #2 – Taking Down Entire Domain Using Vulnerabilities of a SIEM Product", "url": "https://mehmetince.net/unexpected-journey-2-taking-down-entire-domain-using-vulnerabilities-of-a-siem-product/", "published_at": "2017-02-16T06:25:59+00:00" }, { "id": "01a0bb9e-4a88-73c9-9fce-296f51867c40", "title": "Advisory | CVE-2017-6398 Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution", "url": "https://mehmetince.net/advisory-cve-2017-6398-trend-micro-interscan-messaging-security-virtual-appliance-remote-code-execution/", "published_at": "2017-02-07T06:24:01+00:00" }, { "id": "01a0bb9e-4a88-73c9-9fce-296f5249ec8e", "title": "Unexpected Journey into the AlienVault OSSIM/USM During Engagement", "url": "https://mehmetince.net/unexpected-journey-into-the-alienvault-ossim-usm-during-engagement/", "published_at": "2017-01-07T06:31:08+00:00" } ] posts Claim your blog
Back to mehmetince.net
Blog · corpus.blog/blogs/mehmetince.net/posts

mehmetince.net

mehmetince.net

2026

Part 2/6 | Breaking the Postgres Superuser Guardrails: Attacking Security-Hardening Extensions |Systemic Risks in the Managed PostgreSQL Industryoriginal ↗
23 Sept 2026
Part 1/6 | Systemic Risks in the Managed PostgreSQL Industry: Extension Risks Are Real! Exploiting PostGis Memory Corruption Bug at NeonDB, SupaBase and Many Moreoriginal ↗
14 Aug 2026
The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Applianceoriginal ↗
1 Jan 2026

2025

Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain (ZDI-25-099, ZDI-25-097, ZDI-25-096)original ↗
15 Dec 2025
The Chessboard of Security: Insights on Product Development and Vulnerabilities from a Hacker Perspectiveoriginal ↗
7 Nov 2025
Digital Cosmos: A Journey Through the Galaxy of Vulnerabilitiesoriginal ↗
7 Oct 2025

2021

CVE-2021-3825 | LiderAhenk 0day – All your PARDUS Clients Belongs To Meoriginal ↗
21 Dec 2021
CVE-2021-3806 | Pardus 21 Linux Distro – Remote Code Execution 0dayoriginal ↗
13 Sept 2021
CVE-2021-21425 | Unexpected Journey #7 – GravCMS Unauthenticated Arbitrary YAML Write/Update leads to Code Executionoriginal ↗
21 Mar 2021

2020

Vesta Control Panel Second Order Remote Code Execution 0day Step-by-Step Analysisoriginal ↗
18 Mar 2020

2019

Why Secure Design Matters ? Secure Approach to Session Validation on Modern Frameworks (Django Solution)original ↗
8 Sept 2019

2018

CVE-2018-20323 | MailCleaner Community Edition Remote Code Executionoriginal ↗
19 Dec 2018
Unexpected Journey #6 – All ways lead to Rome ! Remote Code Execution on MicroFocus Secure Messaging Gatewayoriginal ↗
22 Jun 2018
Advisory | ManageEngine Applications Manager Remote Code Execution and SQLioriginal ↗
7 Mar 2018

2017

CVE-2017-16666 | Xplico Unauthenticated Remote Code Executionoriginal ↗
6 Nov 2017
One ring to rule them all – Same RCE on multiple Trend Micro productsoriginal ↗
8 Oct 2017
Advisory | DenyAll Web Application Firewall Unauthenticated Remote Code Execution (CVE-2017-14706)original ↗
19 Sept 2017
Advisory | osTicket v1.10 Unauthenticated SQL Injection (CVE-2017-14396 )original ↗
12 Sept 2017
Exploiting Second Order SQLi Flaws by using Burp & Custom Sqlmap Tamperoriginal ↗
6 Aug 2017
Unexpected Journey #5 – From weak password to RCE on Symantec Messaging Gateway (CVE-2017-6326)original ↗
10 Jun 2017
Advisory | Cryptolog Unauthenticated Remote Code Executionoriginal ↗
17 May 2017
Unexpected Journey #4 – Escaping from Restricted Shell and Gaining Root Access to SolarWinds Log & Event Manager (SIEM) Productoriginal ↗
17 Mar 2017
Unexpected Journey #3 – Visiting Another SIEM and Uncovering Pre-auth Privileged Remote Code Executionoriginal ↗
7 Mar 2017
Unexpected Journey #2 – Taking Down Entire Domain Using Vulnerabilities of a SIEM Productoriginal ↗
16 Feb 2017
Advisory | CVE-2017-6398 Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Executionoriginal ↗
7 Feb 2017
Unexpected Journey into the AlienVault OSSIM/USM During Engagementoriginal ↗
7 Jan 2017