Raxis Research Team

The Raxis Research Team is dedicated to staying ahead of the threat landscape. Our experts dig into emerging exploits, uncover hidden vulnerabilities, and develop resources that power our penetration testing engagements. By combining curiosity with technical precision, the team equips Raxis testers with cutting-edge intelligence to simulate real-world attacks and strengthen client defenses.

The author can be reached by contacting us.

Cross-Site Scripting (XSS): Cookie Theft – Advanced Payloads

By Raxis Research Team

Posted in Exploits, How To, Web Apps

We reached into our vaults to bring you the final video in our cross-site scripting (XSS) series. Learn about cookie theft, website defacement, and CSRF attacks.

OWASP Top 10 for 2025: What’s New in Web Application Security

By Raxis Research Team

Posted in In The News, Web Apps

The OWASP Top 10 2025 for web applications release candidate was released last week. Take a look at which categories have moved as well as one new category.

CVE-2022-35739: PRTG Network Monitor Cascading Style Sheets (CSS) Injection

By Raxis Research Team

Posted in Exploits

This CSS vulnerability, discovered by Raxis’ Matt Mathur, lies in a device’s properties and how they are verified and displayed within PRTG Network Monitor.

CVE-2022-26653 & CVE-2022-26777: ManageEngine Remote Access Plus Guest User Insecure Direct Object References

By Raxis Research Team

Posted in Exploits

Raxis lead penetration tester Matt Dunn uncovers two more ManageEngine vulnerabilities (CVE-2022-26653 & CVE-2022-26777).

CVE-2022-25373: ManageEngine Support Center Plus Stored Cross-Site Scripting (XSS)

By Raxis Research Team

Posted in Exploits

Matt Dunn discovers another ManageEngine Cross-Site Scripting vulnerability, this one in the Support Center Plus application.

Raxis Supports Pensacola ROV Team

By Raxis Research Team

Posted in Raxis In The Community

Raxis is proud to sponsor the Pensacola Catholic High School “Crubotics” robotics team. Its members will compete in June 2022’s World Championships in Long Beach, California. The event is part the MATE ROV competioton

CVE-2022-25245: ManageEngine Asset Explorer Information Leakage

By Raxis Research Team

Posted in Exploits

Raxis lead penetration tester Matt Dunn discovers an information leakage vulnerability in ManageEngine’s Asset Explorer CVE-2022-25245

CVE-2022-24681: ManageEngine AD SelfService Plus Stored Cross-Site Scripting (XSS)

By Raxis Research Team

Posted in Exploits

Raxis’ Matt Dunn continues his prolific discovery of new CSS CVEs. This one affects ManageEngine AD SelfService Plus Stored Cross-Site Scripting.

Why We Take Simultaneous Sessions Seriously on Penetration Tests

By Raxis Research Team

Posted in Security Recommendations

Raxis Lead Penetration Tester Matt Dunn explains why you simultaneous sessions is a significant finding on a penetration test.

Jim McClellan, Marketing Director

By Raxis Research Team

Posted in Meet Our Team

Raxis’ new marketing director, Jim McClellan, talks about the unusual career path that led from consultant to full-time team member.

What is Web App Pentesting? (Part Two)

By Raxis Research Team

Posted in Web Apps

Lead penetration tester Matt Dunn continues his discussion about web application testing. In Part Two, Matt explains testing as an authenticated user vs. as an unauthenticated user.

What is Web Application Penetration Testing?

By Raxis Research Team

Posted in Web Apps

Learn how Raxis approaches web application testing and how it differs from network penetration testing. Lead penetration tester Matt Dunn explains in this post.

Cybersecurity Insights From The Frontlines

Raxis Research Team

Cross-Site Scripting (XSS): Cookie Theft – Advanced Payloads

OWASP Top 10 for 2025: What’s New in Web Application Security

CVE-2022-35739: PRTG Network Monitor Cascading Style Sheets (CSS) Injection

CVE-2022-26653 & CVE-2022-26777: ManageEngine Remote Access Plus Guest User Insecure Direct Object References

CVE-2022-25373: ManageEngine Support Center Plus Stored Cross-Site Scripting (XSS)

Raxis Supports Pensacola ROV Team

CVE-2022-25245: ManageEngine Asset Explorer Information Leakage

CVE-2022-24681: ManageEngine AD SelfService Plus Stored Cross-Site Scripting (XSS)

Why We Take Simultaneous Sessions Seriously on Penetration Tests

Jim McClellan, Marketing Director

What is Web App Pentesting? (Part Two)

What is Web Application Penetration Testing?

About Raxis

Resources