Unauthenticated SQL injection in mJobTime (CVE-2026-9209) exposes construction and field services data. No vendor fix exists after 120-day disclosure.
Resources
Blog
Exploitation
Keep up to date with the latest offensive security news, knowledge, and resources.
A new Kerberos delegation abuse path: combine Reflective RBCD, U2U, and an Impacket S4U2Proxy extension to exploit constrained delegation without an SPN.
Apex, one of Sprocket's AI agents, found a session injection flaw in minutes. Human testers chained it into two zero-days.
Emerging React and Next.js vulnerabilities (CVE-2025-55182, CVE-2025-66478): what Sprocket Security is seeing, current detection coverage, and guidance for teams.
Explore a security expert's take on validating the Next.js CVE-2025-29927 exploit, its impact, and techniques for assessing and mitigating the risk.
Social engineering is a method used to manipulate people into divulging confidential information, enabling unauthorized access, or deploying malware.
