Knowledge Base
Explore the latest attack vectors, cybersecurity trends and best practices for building secure software.
All articles (12)
How I Impersonated an Interia Administrator. An Analysis of an SPF Bypass / DMARC Misconfiguration
During routine research we came across a serious flaw in the SPF configuration of Interia.pl that made it possible to send forged emails bypassing sender verification.
Marcin Motwicki·March 26, 2026
APT Emulation with MITRE ATT&CK: Choosing a Group, Techniques, and Metrics
How to build an APT emulation on MITRE ATT&CK v19: a group from CERT Polska and CSIRT GOV reports, techniques from its profile, TIBER-EU scenarios, and per-technique detection metrics.
Marcin Motwicki·September 24, 2026
How Much Does Red Teaming Cost and How Long Does TLPT Take in 2026?
What do red teaming and TLPT cost in Poland and abroad? Sourced, dated price ranges, public tenders, RTS 2025/1190 timelines and DORA Article 27 tester requirements.
Marcin Motwicki
Companies invest in marketing and sales. So who protects what those investments are meant to return?
The campaign budgets are there, the CRM is there, the funnel works. The trouble starts when a company builds growth on a digital environment it does not actually protect. A look at cybersecurity from the business side.
Michał Milewski
When an Application Says Too Much. Information Exposure in CVAT (No CVE)
No CVE does not mean no risk. Two vectors for leaking sensitive diagnostic data in CVAT, from system paths to the internal Nuclio microservice architecture. A classic case of CWE-497.
Marcin Motwicki
Change One HTTP Method and... You Walk Right In. A Classic IDOR in CVAT (CVE-2024-47172)
Changing the HTTP method from GET to PATCH was enough to bypass access control in the popular CVAT tool. A classic IDOR vulnerability with the official identifier CVE-2024-47172.
Marcin Motwicki
When an int Becomes a Malicious Script. Reflected XSS in CVAT (CVE-2024-47064)
A lack of input type validation and output encoding allowed injecting malicious JavaScript into the victim’s browser. Reflected XSS in CVAT scored CVSS 8.1 (High).
Marcin Motwicki
Ping Me and I’ll Tell You Who You Are. A Double IDOR in CVAT Webhooks (CVE-2024-45393)
Predictable identifiers and missing authorization on the webhook endpoints in CVAT enabled data theft and created a DoS risk. A double IDOR with the official identifier CVE-2024-45393.
Marcin Motwicki
A Recipe for Disaster. Unauthenticated PHP Object Injection in the Cooked Pro Plugin (CVE-2022-3900)
A recipe plugin + the unserialize() function = a recipe for disaster. Unauthenticated PHP Object Injection in Cooked Pro, CVSS 9.8 (Critical). CVE-2022-3900.
Marcin Motwicki
Anatomy of a Breach: A Ransomware Attack on the Polish Healthcare Sector
A detailed analysis of a real ransomware incident that paralyzed a hospital network. From the initial access vector to full remediation — step by step.
Marcin Motwicki
How to Secure an API Against Attacks? A Practical Guide
In the age of microservices, the API is the backbone of modern software. Learn the key practices for protecting programming interfaces against attacks.
Marcin Motwicki
What Is NIS2 and What Your Company Must Do
What the NIS2 Directive is, how Poland’s amended KSC Act implements it and what it means for a company: obligations, incident reporting, deadlines and fines.
Marcin Motwicki