Knowledge Base
Explore the latest attack vectors, cybersecurity trends and best practices for building secure software.
All articles (10)
How I Impersonated an Interia Administrator. An Analysis of an SPF Bypass / DMARC Misconfiguration
During routine research we came across a serious flaw in the SPF configuration of Interia.pl that made it possible to send forged emails bypassing sender verification.
Marcin Motwicki·March 11, 2026
Companies invest in marketing and sales. So who protects what those investments are meant to return?
The campaign budgets are there, the CRM is there, the funnel works. The trouble starts when a company builds growth on a digital environment it does not actually protect. A look at cybersecurity from the business side.
Michał Milewski·July 30, 2026
Ping Me and I’ll Tell You Who You Are. A Double IDOR in CVAT Webhooks (CVE-2024-45393)
Predictable identifiers and missing authorization on the webhook endpoints in CVAT enabled data theft and created a DoS risk. A double IDOR with the official identifier CVE-2024-45393.
Marcin Motwicki
When an int Becomes a Malicious Script. Reflected XSS in CVAT (CVE-2024-47064)
A lack of input type validation and output encoding allowed injecting malicious JavaScript into the victim’s browser. Reflected XSS in CVAT scored CVSS 8.1 (High).
Marcin Motwicki
Change One HTTP Method and... You Walk Right In. A Classic IDOR in CVAT (CVE-2024-47172)
Changing the HTTP method from GET to PATCH was enough to bypass access control in the popular CVAT tool. A classic IDOR vulnerability with the official identifier CVE-2024-47172.
Marcin Motwicki
When an Application Says Too Much. Information Exposure in CVAT (No CVE)
No CVE does not mean no risk. Two vectors for leaking sensitive diagnostic data in CVAT, from system paths to the internal Nuclio microservice architecture. A classic case of CWE-497.
Marcin Motwicki
A Recipe for Disaster. Unauthenticated PHP Object Injection in the Cooked Pro Plugin (CVE-2022-3900)
A recipe plugin + the unserialize() function = a recipe for disaster. Unauthenticated PHP Object Injection in Cooked Pro, CVSS 9.8 (Critical). CVE-2022-3900.
Marcin Motwicki
Anatomy of a Breach: A Ransomware Attack on the Polish Healthcare Sector
A detailed analysis of a real ransomware incident that paralyzed a hospital network. From the initial access vector to full remediation — step by step.
Marcin Motwicki
How to Secure an API Against Attacks? A Practical Guide
In the age of microservices, the API is the backbone of modern software. Learn the key practices for protecting programming interfaces against attacks.
Marcin Motwicki
NIS2 in Practice: What You Must Implement by October 2026
The NIS2 Directive places new obligations on operators of essential services. See which requirements you must meet and how to prepare for them.
Marcin Motwicki