https://nullcathedral.com/Where nothing is sacred.en-usNULL CATHEDRALWed, 18 Mar 2026 00:00:00 +0000Fri, 10 Apr 2026 18:00:00 +0000https://www.rssboard.org/rss-specification60https://nullcathedral.com/favicon.svghttps://nullcathedral.com/https://nullcathedral.com/posts/2026-03-18-roundcube-round-two-three-more-sanitizer-bypasses/Three more bypasses in Roundcube's HTML sanitizer: SMIL animation attributes load remote resources, unquoted body backgrounds enable CSS injection, and position:fixed !important enables phishing overlays.vulnerabilityroundcubesvgcssemail-securityhttps://nullcathedral.com/posts/2026-03-18-roundcube-round-two-three-more-sanitizer-bypasses/Wed, 18 Mar 2026 00:00:00 +0000https://nullcathedral.com/posts/2026-03-16-perfex-crm-unauthenticated-rce-insecure-deserialization/Perfex CRM passed the autologin cookie into unserialize() without validation, giving unauthenticated attackers remote code execution.vulnerabilityperfex-crmdeserializationrcephphttps://nullcathedral.com/posts/2026-03-16-perfex-crm-unauthenticated-rce-insecure-deserialization/Mon, 16 Mar 2026 00:00:00 +0000https://nullcathedral.com/posts/2026-02-10-hello-world/About this blog and the author behind it.metahttps://nullcathedral.com/posts/2026-02-10-hello-world/Tue, 10 Feb 2026 00:00:00 +0000https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/Roundcube's HTML sanitizer doesn't treat SVG feImage href as an image source. Attackers can bypass remote image blocking to track email opens. (CVE-2026-25916)vulnerabilityroundcubesvgemail-securityhttps://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/Sun, 08 Feb 2026 00:00:00 +0000