DISCOVERIES
CVEs, Research & Real-World Findings
Security research and vulnerabilities discovered by Hacklantic, including published CVEs and anonymised findings from real-world client engagements. Explore the technical analysis, exploitation details and proof-of-concept demonstrations behind each discovery.
CVE-2024-36058CriticalCVSS 9.8
Hacking Koha, Part 1:Time-Based Blind SQL Injection
Low-privilege blind SQL injection through the OPAC “Send Basket” feature.
CVE-2024-36057CriticalCVSS 9.8
Hacking Koha, Part 2:Authenticated OS Command Injection
Authenticated remote code execution via a crafted cover-image upload.
No real-world findings published yet.