Priyanka Aash is credited with building global communities for cybersecurity leaders and shaping enterprise marketing strategies for over a decade. She has been nominated for the Cybersecurity Excellence Award for her leadership & AI innovations in cybersecurity and honored with the NetApp Excellerate HER award. She is also the author of “The AI Divide,” which explores how artificial intelligence is quietly rewiring human minds and influencing decisions. Earlier, she co-founded CISO Platform, the world’s first online platform for collaboration and knowledge sharing among senior information security executives. Through this, she worked with the marketing teams of IBM, VMware, F5 Networks, Barracuda Networks, Check Point, and others, driving inbound marketing and enterprise growth. Priyanka is passionate about entrepreneurship, enterprise marketing strategy, and building communities that empower CISOs worldwide.
Description: Injection vulnerability in Cisco ISE API enabling unauthenticated RCE. Technical Details: CVSS Score: 10.0 (Critical) Exploit: Attackers submit crafted POST requests to /admin/XXX endpoints with malicious JSON payloads ({“command”:”exec”}), exploiting insufficient input validation to execute code with root privileges. Bobby Gould’s PoC showed unsafe deserialization in JSON inputs, enabling RCE from Chinese IPs (e.g.,… Read More »CVE-2025-20281 (Cisco ISE)
Overview: Indian crypto exchange CoinDCX was breached, with attackers stealing wallet credentials and transaction data, causing $1.2M in losses. Technical Details: Attack Vector: Exploited CVE-2025-20281 (Cisco ISE injection vulnerability, CVSS 10.0) in a third-party payment gateway’s API endpoint (/admin/XXX) integrated with CoinDCX. Exploitation: Attackers sent crafted POST requests (Content-Type: application/json) with malicious SQL payloads (‘… Read More »CoinDCX Cryptocurrency Exchange Breach
Description: Vulnerability enabling administrator takeover via XML-based exploits. Technical Details: CVSS Score: 9.2 (Critical) Exploit: Attackers exploit weak XML validation to inject payloads that modify role_id fields (<user><role_id>admin</role_id></user>), escalating to admin privileges. The attack targets /api/v1/admin endpoints, chaining with CVE-2025-2775 for initial data access. Persistence is achieved via modified user accounts with SSH keys added… Read More »CVE-2025-2776 (SysAid On-Prem)
Description: Deserialization vulnerability enabling unauthenticated RCE via the /_layouts/15/ToolPane.aspx endpoint. Technical Details: CVSS Score: 9.8 (Critical) Exploit: Attackers craft malicious ASPX payloads (spinstall0.aspx) to exploit unsafe deserialization, extracting ValidationKey and DecryptionKey from __VIEWSTATE. Spoofed Referer headers (/layouts/SignOut.aspx) bypass authentication. The exploit chains with CVE-2025-49704 (spoofing, CVSS 8.8) and CVE-2025-49706 (RCE bypass), deploying .dll payloads (SHA256:… Read More »CVE-2025-53770 (Microsoft SharePoint)
Overview French luxury brand Dior suffered a data breach exposing customer and employee data, attributed to Chinese state-sponsored actors, likely DCHSpy, linked to the ShinyHunters group via a third-party vendor breach (LVMH). Technical Details: Attack Vector: Exploited a misconfigured AWS S3 bucket with public read permissions (“Effect”: “Allow”, “Principal”: “*”) and no IAM role-based controls,… Read More »Dior Data Breach