RCE Security

RCE Security provides penetration testing, source code reviews, bug bounty support, and offensive security services for web, mobile, APIs, and infrastructure.

[RCE Security @rcesecurity]

Turning an encrypted backup into Remote Code Execution in Stackfield’s desktop app (CVE-2026-28373).

#security

https://t.co/a1ikMGmwjz

[RCE Security @rcesecurity]

Pwning TRUfusion Enterprise again: chaining a pre-auth SSRF (CVE-2025-32355), a default password, and a path traversal (CVE-2025-59793) to gain RCE.

#security

https://t.co/kkVDeAnTVi

[RCE Security @rcesecurity]

We took @_WPScan_'s one-liner #security advisory for CVE-2025-9501 affecting the W3 Total Cache plugin for #WordPress, analysed its cache parsing internals and built a pre-auth RCE exploit for it 😎

https://t.co/zgCf028Yts

#infosec

[RCE Security @rcesecurity]

Our friends @HashiCorp released a new version of Consul fixing our reported Denial of Service vulnerabilities (CVE-2025-11374 and CVE-2025-11375).

See our official advisories for the details and remediation steps: https://t.co/3oUxeUX7S0

#security

[RCE Security @rcesecurity]

Another day, another Remote Code Execution (and its 3 friends).

Pre-auth path traversal, hard-coded crypto key allowing cookie forgery, arbitrary file write, and PII disclosure in TRUfusion Enterprise (CVE-2025-27222 to CVE-2025-27225) #security

https://t.co/YIjFDT7CBM

[RCE Security @rcesecurity]

We've just updated our latest blog post about CVE-2025-47812 to include another disclosure that went a little under the radar but could be used to leak a user's password: CVE-2025-27889.

#security #BugBounty

https://t.co/yaTdGEWEzO

[RCE Security @rcesecurity]

During a customer pentest, we went from anonymous Read-Only FTP access to full root-level remote code execution by abusing a string parsing discrepancy in Wing FTP's username handling.

#security #BugBounty

https://t.co/yaTdGEW6Kg

[RCE Security @rcesecurity]

Here's a short write-up about CVE-2023-6542 a #security vulnerability affecting the SAP Emarsys SDK for Android allowing attackers to leak sensitive data from an app's private data directory and also load remote contents into an app overlay.

https://t.co/CkSAGgSlAQ