Vulnerability Research Labs

Vulnerability research unit of @QuantroSecurity

[Vulnerability Research Labs @vulnresearchlab]

The user authentication system in OctoberCMS had an authentication bypass. We reproduced the public vulnerability (CVE-2021-32648), built an exploit, and verified the vendor patch closes it. 7m 49s and $1.81, end to end.

[Vulnerability Research Labs @vulnresearchlab]

Getting full database access to a WordPress site via the Business Directory Plugin cost us $2.91 and 14m 27s. We reproduced the public unauthenticated SQL injection in CVE-2024-4443 and verified the vendor fix.

[Vulnerability Research Labs @vulnresearchlab]

An authentication API that can be bypassed entirely. We reproduced the public CVE-2023-2732 in MStore API. Exploit built and patch verified in 5m 19s, for a cost of $1.07.

[Vulnerability Research Labs @vulnresearchlab]

An experimental DNS query type crashes PowerDNS. We reproduced the public CVE-2021-36754. The interesting bit isn't the out-of-bounds read; it's that building the exploit and verifying the fix took 8m 28s.

[Vulnerability Research Labs @vulnresearchlab]

A NULL pointer dereference in the Apache web server that can cause a crash. We reproduced the public CVE-2018-8011, built an exploit, and confirmed the vendor patch closes it. Total time: 10m 25s. Compute cost: $2.01.

[Vulnerability Research Labs @vulnresearchlab]

A classic use-after-free memory corruption bug in KeyDB. We reproduced the public CVE-2025-49844, built a working exploit, and confirmed the vendor fix. The whole process took 16m 42s and cost $5.69.

[Vulnerability Research Labs @vulnresearchlab]

Deserializing untrusted data leads to unauthenticated remote code execution in Jenkins. We reproduced the public CVE-2017-1000353 from exploit build to patch verification in 8m 13s. Compute cost: $1.29.

[Vulnerability Research Labs @vulnresearchlab]

It took 14m 1s and $2.48 to reproduce the public command injection in Apache Struts (CVE-2016-3081). We built the exploit, ran it, then rebuilt on the patched version to confirm the fix.

[Vulnerability Research Labs @vulnresearchlab]

A command injection in a web admin panel is about as direct as it gets. We reproduced the public CVE-2019-15107 in Webmin end-to-end. Exploit built and patch verified in 20m 4s for $6.52.

[Vulnerability Research Labs @vulnresearchlab]

A code editor with a basic cross-site scripting flaw that allows local code execution. We reproduced the public CVE-2026-41611 in Visual Studio Code and verified the patch. 11m 54s, $3.58.

[Vulnerability Research Labs @vulnresearchlab]

An identity system's password recovery flow let us take over any account without authentication. We reproduced the public CVE-2026-18963 in Red Hat Build of Keycloak. Building the exploit and verifying the fix took 15m 57s and cost $2.89.

[Vulnerability Research Labs @vulnresearchlab]

A path traversal in Atlassian Confluence allowed for arbitrary file write and remote code execution. We reproduced the public exploit for CVE-2019-3398 and confirmed the vendor patch closes it. Compute cost for the run was $0.71.

[Vulnerability Research Labs @vulnresearchlab]

The checkout process is where an e-commerce platform must be most careful. An input validation flaw in Magento's, CVE-2022-24086, allowed for arbitrary code execution. We reproduced the public vulnerability and verified the fix.

[Vulnerability Research Labs @vulnresearchlab]

The point of verifying an email address is so you can trust it for things like password resets. CVE-2023-7028 allowed GitLab password resets to be sent to an unverified address. We reproduced the public finding and verified the patch.

[Vulnerability Research Labs @vulnresearchlab]

An EPSS score of 0.99999 suggests active exploitation is a near certainty. We reproduced the public auth bypass in Atlassian Confluence, CVE-2023-22518. Total cost to build the exploit and verify the fix was $0.84.

[Vulnerability Research Labs @vulnresearchlab]

Deserializing data you don't trust is a reliable way to get remote code execution. This one is CVE-2025-49113, a public vulnerability in Roundcube webmail. We built the exploit and verified the vendor's patch closes it.