https://tpaidakis.com/Recent content on tpaidakisHugoen-usMon, 03 Aug 2026 00:00:00 +0300https://tpaidakis.com/writeups/openclaw-dashboard-stored-xss/Mon, 03 Aug 2026 00:00:00 +0300https://tpaidakis.com/writeups/openclaw-dashboard-stored-xss/Two stored XSS bugs in OpenClaw Dashboard, both the same missing encode on the way to innerHTML. One is reachable by an unauthenticated visitor through the login form, the other fires on a background timer with no admin click at all.https://tpaidakis.com/writeups/passwordpusher-nil-authorization/Sun, 02 Aug 2026 00:00:00 +0300https://tpaidakis.com/writeups/passwordpusher-nil-authorization/An unauthenticated visitor holding only a Password Pusher link could permanently destroy the secret behind it, even with deletable_by_viewer turned off, because the ownership check compared two nils and Ruby said they matched.https://tpaidakis.com/writeups/facilio-parser-dos/Thu, 30 Jul 2026 00:00:00 +0300https://tpaidakis.com/writeups/facilio-parser-dos/Three unauthenticated denial-of-service bugs in facil.io&rsquo;s hand-written HTTP and multipart parsers, all the same shape: a value that is correct where it is computed and wrong by the time someone uses it.https://tpaidakis.com/writeups/camaleon-cms-rce-select-eval/Wed, 29 Jul 2026 00:00:00 +0300https://tpaidakis.com/writeups/camaleon-cms-rce-select-eval/A select field with Ruby eval support and no sanitization becomes a remote code execution vector in Camaleon CMS, exploitable by any editor-level account.https://tpaidakis.com/about/Mon, 01 Jan 0001 00:00:00 +0000https://tpaidakis.com/about/<p>I&rsquo;m a penetration tester in the payments sector - most of my time is in PCI DSS scope. Before offensive security I spent several years as a software engineer.</p> <p>I hold a BSc in Software Engineering and an MSc in Cybersecurity. Growing up I was running scripts I barely understood and poking at things I probably should not have been. The interest was always there, it just took a while to become a job.</p>