Khanh Nguyen

Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter

Privilege escalation in the DOM: Service Workers component

Privilege escalation in the DOM: Workers component

Site isolation issue in the WebExtensions component

Privilege escalation in the Shell Integration component

Privilege escalation in the DOM: Navigation component

ICS Calendar <= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter

Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter

List Category Posts <= 0.91.0 - Authenticated (Contributor+) SQL Injection via Plugin's Shortcode