# Voke Cyber > Expert penetration testing services based in the Charlotte, NC area. No fillers, just findings. Speak directly with the tester performing your assessment. Voke Cyber is a specialized penetration testing firm founded by Louis Sanchez (OSCP, OSWA, CISSP, CCSK). We deliver manual security assessments for web applications, APIs, mobile apps, cloud environments, networks, and more. Every engagement includes free retesting, direct tester communication, and actionable reporting. ## Company Info - Website: https://vokecyber.com - Email: info@vokecyber.com - Phone: (765) 422-5464 - Location: Charlotte, NC area (Greater Charlotte metro) - Founder: Louis Sanchez — 18 years InfoSec, 7+ years offensive security, 1,000+ pentests completed ## Services - [Web Application Penetration Testing](https://vokecyber.com/services/web-application): OWASP WSTG-aligned testing of authentication, authorization, business logic, and input validation. - [API Security Testing](https://vokecyber.com/services/api): Full-scope testing of REST, GraphQL, and other API architectures against the OWASP API Top 10. - [Mobile Application Testing](https://vokecyber.com/services/mobile): iOS and Android security assessments aligned with OWASP MSTG including static/dynamic analysis. - [Cloud Security Assessment](https://vokecyber.com/services/cloud): Cloud environment evaluations based on CIS Benchmarks for AWS, Azure, and GCP. - [Network Penetration Testing](https://vokecyber.com/services/network): External and internal network testing aligned with PTES methodology. - [External Penetration Testing](https://vokecyber.com/services/external-pentest): Black-box assessment of internet-facing infrastructure. - [Internal Penetration Testing](https://vokecyber.com/services/internal-pentest): Assessment of internal network security from an insider threat perspective. - [Red Team Assessment](https://vokecyber.com/services/red-team): Full-scope adversary simulation aligned with MITRE ATT&CK framework. - [Phishing Simulation & Training](https://vokecyber.com/services/phishing): Targeted phishing campaigns with behavioral analytics and follow-up training. - [LLM/AI Penetration Testing](https://vokecyber.com/services/ml-ai): LLM and AI penetration testing aligned with OWASP LLM Top 10 2025 for prompt injection, sensitive information disclosure, supply chain risks, and more. - [EU AI Act Cybersecurity Assessment](https://vokecyber.com/services/eu-ai-act): Article 15 adversarial security testing, AI red-teaming, data pipeline security, GPAI assessment, and Annex IV conformity evidence for high-risk AI systems. August 2026 deadline. - [IoT & Embedded Systems Testing](https://vokecyber.com/services/iot): Hardware and firmware security assessments covering device interfaces and communication protocols. - [Thick Client Application Testing](https://vokecyber.com/services/thick-client): Desktop application security testing including client-server communication and reverse engineering. - [PCI Compliance Scanning](https://vokecyber.com/services/pci): PCI DSS-compliant vulnerability scanning using ASV methodology. - [Vulnerability Assessment](https://vokecyber.com/services/vulnerability-assessment): Automated and manual vulnerability scanning and assessment. - [Healthcare Penetration Testing](https://vokecyber.com/services/healthcare): HIPAA-aligned testing for healthcare organizations — EHR systems, patient portals, medical devices, and healthcare APIs. - [FinTech Penetration Testing](https://vokecyber.com/services/fintech): Security testing for financial services — payment processing, banking portals, trading platforms, and financial APIs. PCI DSS and SOC 2 compliance support. - [SaaS Penetration Testing](https://vokecyber.com/services/saas): Multi-tenant isolation testing, API abuse prevention, authentication and SSO security, privilege escalation across tenants, and third-party integration security. - [E-Commerce Penetration Testing](https://vokecyber.com/services/ecommerce): Secure payment flows, prevent account takeover, protect customer data, and test business logic like coupon abuse and price manipulation. - [Manufacturing Penetration Testing](https://vokecyber.com/services/manufacturing): Secure IT/OT networks, cloud-connected systems, ERP platforms, and prevent operational disruption from ransomware and lateral movement. - [Education Penetration Testing](https://vokecyber.com/services/education): Protect student data, secure LMS platforms and student portals, and meet FERPA compliance requirements. ## Security Research Original vulnerability research and CVE advisories from Voke Cyber. - [Security Research hub](https://vokecyber.com/research): CVEs and advisories Voke Cyber has found and responsibly disclosed. - [Leantime JSON-RPC Account Takeover via editOwn](https://vokecyber.com/research/leantime-jsonrpc-editown-account-takeover): Authorization bypass (CWE-639/CWE-862) in Leantime, the open-source PHP/Laravel project management platform. The editOwn self-service profile method is exposed through the JSON-RPC endpoint at /api/jsonrpc, which resolves the service out of the container and calls it with the request body parameters, never passing through the web controller that pins the record to the session. The caller therefore supplies the user id being edited and nothing compares it to the caller, so any authenticated account can overwrite any other user row and, because a supplied password is hashed and stored, set a known password on the instance owner and log in as them. A read-only or invited-client login is sufficient. CVSS 8.8 High, rising to 9.8 where self-registration is enabled. CERT/CC VU#685483. The original private report, GHSA-jxgw-q79v-g84j, was closed by the maintainer without substantive review; Voke Cyber subsequently opened GHSA-5447-phq9-qjmm. Both GitHub advisories and the CERT/CC note remain non-public as of 2026-08-18, so there is no public record of the issue other than the Voke Cyber advisory. Affected Leantime 3.x through v3.8.0; silently fixed in v3.9.0 via PR #3471, a pull request titled after a permission-engine refactor, with no security advisory and no changelog entry naming it. Distinct from the four Leantime JSON-RPC CVEs published by third parties in July 2026 (CVE-2026-59712, CVE-2026-15509, CVE-2026-15510, CVE-2026-59713). Assigned CVE-2026-76647, published by CERT/CC on 2026-08-19. Found by Voke Cyber. - [CVE-2026-16772 — Privilege Escalation to Admin in Akaunting via Self-Service Profile Update](https://vokecyber.com/research/cve-2026-16772-akaunting-privilege-escalation): Missing authorization (CWE-862/CWE-269) in Akaunting, the open-source accounting and invoicing platform. When a user saves their own profile, the UpdateUser job synchronizes the submitted list of roles to the account with no authorization check — its authorize() method only guards self-disabling and an orphan-company case, never asking whether the caller may assign roles. Any account holding the default update-auth-profile permission, which the seeded manager and accountant roles both carry, can add the administrator role to itself and gain full control of the company's books: read and alter every invoice, bill, customer, vendor, and bank detail, manage users, and change settings. The JSON API path is correctly gated (it inherits update-auth-users middleware), so scope is the web self-update path only. CVSS 8.1 High. CERT/CC VU#737420. Affected Akaunting ≤ 3.1.21. No fix at publication. Found by Voke Cyber; disclosed via CERT/CC after the vendor did not respond. - [CVE-2026-17613 — Cross-Team File Takeover in Penpot via import-binfile](https://vokecyber.com/research/cve-2026-17613-penpot-cross-team-file-takeover): Authorization bypass (CWE-639/CWE-862) in Penpot, the open-source Figma alternative. The import-binfile RPC command accepts an optional caller-supplied file-id for in-place import; the handler validates edit permission on the caller's own project but never checks the file-id belongs to the caller, while the adjacent export-binfile command validates its file-id correctly. Any authenticated user can overwrite any file on the instance, and the import also re-parents the file into the attacker's project, so Penpot's file→project→team permission walk then treats the attacker as the legitimate owner: the victim's design is destroyed, transferred, and unreachable. File ids leak via public share links, shared-library listing calls, and workspace/viewer URLs. Shared design libraries poison every dependent file across other teams. CVSS 7.5 High, 6.5 where self-registration is closed. GHSA-8qqw-wm58-45v7, CERT/CC VU#241166. Affected v1.20 onward, self-hosted CE and Penpot Cloud. No fix at publication. Found by Voke Cyber; disclosed via CERT/CC. - [CVE-2026-16751 — Account Takeover in Ente via Emergency-Contact Recovery Bypass](https://vokecyber.com/research/cve-2026-16751-ente-emergency-recovery-bypass): Authorization bypass (CWE-639/CWE-863) in Ente's emergency-contact recovery. The approval endpoint never verified the recovery session belonged to the caller, so a former emergency contact could flip a recovery from waiting to ready in one request, collapse the 30-day safety window to zero, reset the victim's password, and take over the account — end-to-end encrypted photos, Ente Auth 2FA seeds, and Locker secrets — in under a minute; the recovery flow also wiped the victim's 2FA. CVSS 6.5 Medium. GHSA-9jcx-2fcp-hxmf, CERT/CC VU#834187. Fixed in vendor PR #11311. Found by Voke Cyber. - [Cal.com Cross-Tenant Webhook Plant](https://vokecyber.com/research/calcom-cross-tenant-webhook-plant): Authorization bypass (CWE-639/CWE-862) in Cal.com's webhook-create API; the request accepts a teamId that is never checked against the caller's team memberships, so any authenticated user can attach a webhook to any team by its numeric id and exfiltrate every booking's attendee PII (name, email, phone), intake answers, organizer email, and the video-call URL and password to an attacker-controlled URL, signed with an attacker-chosen secret. Rooted in open-source stub permission checks that return "allowed." CVSS 9.6 Critical. CVE-2026-16624, GHSA-4fwh-xxpv-xfm6. No fix at publication. Found by Voke Cyber; disclosed via CERT/CC. - [CVE-2026-15630 — Casdoor Cross-Tenant Authorization Bypass](https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz): Cross-tenant authorization bypass (CWE-863/CWE-639) in Casdoor IAM; the global authorization filter resolves the target object from the URL ?id= while the affected controllers act on the JSON request body, across roughly 25 add/delete endpoints. Any organization admin can delete users, plant a backdoor admin, wipe SSO certificates, and plant Casbin rules in any other tenant, escalating to instance-wide global admin. CVSS 9.9 Critical. No fix at publication. Found by Voke Cyber; disclosed via CERT/CC (VU#889462). - [CVE-2026-39878 — Chamilo LMS Unauthenticated Stored XSS](https://vokecyber.com/research/cve-2026-39878-chamilo-lms-stored-xss): Stored XSS (CWE-79) in Chamilo LMS self-registration; a null byte inside an event handler defeats HTMLPurifier, and the admin user list renders the stored name without escaping, firing the payload in an administrator's session and enabling full platform admin takeover. CVSS 9.3 Critical. Found by Voke Cyber; fixed in 1.11.40. - [CVE-2026-48742 — Coolify Cross-Team IDOR](https://vokecyber.com/research/cve-2026-48742-coolify-cross-team-idor): Insecure direct object reference (CWE-639/CWE-862) in Coolify's service views; any authenticated user on a shared instance can read, modify, and redeploy services belonging to other teams, with a code execution path via container image swap. CVSS 9.9 Critical. Found by Voke Cyber; fixed in v4.1.1. - [CVE-2026-35198 — HeyForm Stored XSS](https://vokecyber.com/research/cve-2026-35198-heyform-stored-xss): Stored cross-site scripting (CWE-79) in HeyForm's rich-text form fields; any team member can implant a persistent XSS payload enabling full team ownership takeover. CVSS 8.7 High. Found by Voke Cyber; fixed silently in commit cc97d27 with no public advisory. - [CVE-2026-48507 — Snipe-IT Admin Lockout](https://vokecyber.com/research/cve-2026-48507-snipe-it-admin-lockout): Incorrect authorization (CWE-863) in Snipe-IT's bulk user editing; a user with only the users.edit permission can lock every admin out of the instance. Found by Voke Cyber; fixed in Snipe-IT 8.6.0. - [CVE-2026-42318 — GLPI Arbitrary Item Deletion](https://vokecyber.com/research/cve-2026-42318-glpi-arbitrary-deletion): Authorization bypass (CWE-862) in GLPI's planning module; a technician-level user can delete any object. Found by Voke Cyber; fixed in GLPI 10.0.25 and 11.0.7. - [Vulnerability Disclosure Policy](https://vokecyber.com/research/disclosure-policy): How Voke Cyber handles coordinated disclosure for the vulnerabilities we find, and how to report a security issue to us. ## Pages - [Home](https://vokecyber.com/): Overview of services, differentiators, trust badges, and client testimonials. - [All Services](https://vokecyber.com/services): Complete list of penetration testing services offered. - [About Us](https://vokecyber.com/about): Company background, founder bio, certifications, and why clients choose Voke Cyber. - [Louis Sanchez — Founder & Principal Security Consultant](https://vokecyber.com/about/louis-sanchez): Bio, certifications (OSCP, OSWA, CISSP, CCSK), and background of Voke Cyber's founder and lead penetration tester. - [Get Started](https://vokecyber.com/get-started): Multi-step scoping form to request a penetration testing quote. - [Contact](https://vokecyber.com/contact): Contact form, email, phone, and location information. - [FAQ](https://vokecyber.com/faq): Frequently asked questions about penetration testing, process, and methodology. - [Blog](https://vokecyber.com/blog): Security insights and industry updates. - [The Profile Method That Would Edit Anyone: An IDOR in Leantime's JSON-RPC](https://vokecyber.com/blog/leantime-jsonrpc-editown-account-takeover): The story behind a CVSS 8.8 account takeover in Leantime. The same editOwn method was safe through the browser and wide open over the API, because the only thing pinning it to your own account lived in a controller the JSON-RPC path never called. The central lesson generalizes well past Leantime: when an application exposes its service layer over RPC, every authorization check that lives in a controller quietly stops being a control, and self-service methods take the worst of it because they were written assuming the id could only ever be the caller's. Also covers why silent patching is a bad practice rather than a cautious one: attackers read commit diffs, so a public repository publishes the exploit the moment the fix merges, while defenders relying on CVE feeds, Dependabot alerts, and release notes get nothing. The practical outcome inverts the intent - the exploit is public in the diff and the warning is not, leaving an administrator still on 3.8.0 with a live account-takeover path and no reason to think the upgrade is urgent. Fixed in v3.9.0; carve-out CVE granted as CVE-2026-76647, published by CERT/CC on 2026-08-19 (VU#685483). Found and disclosed by Voke Cyber. - [When CVSS Scores the Endpoint, Not the Loss](https://vokecyber.com/blog/when-cvss-scores-the-endpoint-not-the-loss): Why the same vulnerability can honestly carry two very different CVSS scores, using our Ente account takeover (CVE-2026-16751) as the worked example: we scored it 9.9 Critical, the CVE record scores it 6.5 Medium with C:N — no confidentiality impact — for a bug that yields end-to-end encrypted photos and Ente Auth 2FA seeds. The 6.5 is defensible because the flawed request only changes a recovery session's status without authorization; the disclosure arrives one step later through a password reset that is documented functionality, not a second vulnerability. It is also misleading, because the control that was bypassed existed precisely to prevent that reset. Same pattern in our Penpot finding (CVE-2026-17613), scored availability-only at 7.5 despite the attacker keeping a readable copy of the victim's file. Covers vulnerability chaining, why base metrics exclude your environment, why the SSVC "automatable: yes" field in the same enrichment record was more actionable than the score, and why we publish the assigned number on our advisories while keeping the impact analysis intact. - [The Profile Page That Handed Out Admin: CVE-2026-16772 in Akaunting](https://vokecyber.com/blog/cve-2026-16772-akaunting-privilege-escalation): The story behind a CVSS 8.1 privilege escalation in Akaunting, the open-source accounting platform. You open your own profile, add the admin role to the form, and save — the server makes you an administrator because you told it to. The update job takes the submitted role list at its word, and "edit your own record" and "assign your own roles" went through the same door. The sibling JSON API path gates the same operation correctly, so the knowledge of how to check was already in the codebase, one controller over. Also covers scoping a finding down to what can actually be proven: a cross-tenant API variant was chased and ruled out, precisely because the API does its permission check. Fixed in Akaunting 3.2.0 (commit 80ef6d3b154a, 2026-07-12), shipped silently with no vendor advisory. Disclosed via CERT/CC (VU#737420). Found and disclosed by Voke Cyber. - [HIPAA Penetration Testing Requirements](https://vokecyber.com/blog/hipaa-penetration-testing-requirements): What the HIPAA Security Rule actually requires today (risk analysis § 164.308(a)(1), evaluation § 164.308(a)(8)), what OCR expects when it investigates, and the proposed Security Rule update that would mandate penetration testing every 12 months and vulnerability scanning every 6 months for covered entities and business associates. - [The Import That Took the File With It: CVE-2026-17613 in Penpot](https://vokecyber.com/blog/cve-2026-17613-penpot-cross-team-file-takeover): The story behind a CVSS 7.5 cross-team file takeover in Penpot, the open-source Figma alternative. The import API checks the project you own and never checks the file id you supplied, so one request overwrites any file on the instance — and because the import also rewrites the file's owning project, the attacker does not bypass the permission model, they satisfy it. The victim's design is destroyed, owned by someone else, and unreachable, with no in-product restore path. Includes why attack complexity stays Low even though file ids are unguessable, and the lesson that the correct check on the adjacent export path proves the team knew: symmetric features (import/export, create/update, single/bulk) should be reviewed as pairs. No patch available; disclosed via CERT/CC (VU#241166). Found and disclosed by Voke Cyber. - [The Safety Window That Closed in One Request: CVE-2026-16751 in Ente](https://vokecyber.com/blog/cve-2026-16751-ente-emergency-recovery-bypass): The story behind a CVSS 6.5 account takeover in Ente, the end-to-end encrypted photos/2FA/passwords service. The emergency-contact recovery approval step never checked the session belonged to the caller, so a former trusted contact could skip the multi-day waiting period in one request and seize the account, including the Ente Auth 2FA seeds that protect the victim's other accounts. The lesson: the most dangerous place for a missing authorization check is inside the feature whose whole job is to be safe. Vendor fixed it (PR #11311). Found and disclosed by Voke Cyber. - [A Scheduling Tool Turned Into a Wiretap: The Cal.com Webhook That Trusts Its Own Input](https://vokecyber.com/blog/calcom-cross-tenant-webhook-plant): The story behind a CVSS 9.6 cross-tenant webhook plant in Cal.com. The webhook-create API checks ownership for the id and eventType paths but never validates the teamId, so any authenticated user can wiretap any team's bookings with one API call. Root cause: open-core stub permission checks that always return allowed. No patch available; disclosed via CERT/CC. Found and disclosed by Voke Cyber. - [When the Authorization Check and the Action Look at Different Objects: CVE-2026-15630 in Casdoor](https://vokecyber.com/blog/cve-2026-15630-casdoor-cross-tenant-authz): The story behind CVE-2026-15630 in Casdoor. The authorization check is not missing — it runs and approves for a good reason, then the controller acts on a different object than the filter authorized, because the filter keys on the URL ?id= and the controllers key on the JSON body. CVSS 9.9 cross-tenant takeover from a routine org-admin account, no patch available. Found and disclosed by Voke Cyber via CERT/CC. - [The Null Byte That Walked Past HTMLPurifier: CVE-2026-39878 in Chamilo LMS](https://vokecyber.com/blog/cve-2026-39878-chamilo-lms-stored-xss): How a single null byte inside an event handler slipped a stored XSS payload past HTMLPurifier at registration, and an unescaped admin user list fired it in the administrator's session. CVSS 9.3 Critical unauthenticated admin takeover. Found and disclosed by Voke Cyber. - [Authorization Temporarily Disabled: CVE-2026-48742 in Coolify](https://vokecyber.com/blog/cve-2026-48742-coolify-cross-team-idor): How a "temporarily disabled" policy comment left every Coolify team exposed to cross-tenant service takeover and container code execution. CVSS 9.9 Critical. Found and disclosed by Voke Cyber. - [CVE-2026-35198: HeyForm Stored XSS Fixed Silently](https://vokecyber.com/blog/cve-2026-35198-heyform-stored-xss): CVSS 8.7 stored XSS in HeyForm's rich-text form fields. Fixed in a commit with no public advisory, no Dependabot alert, no NVD entry. Found and disclosed by Voke Cyber. - [How We Found CVE-2026-48507 in Snipe-IT](https://vokecyber.com/blog/cve-2026-48507-snipe-it-admin-lockout): The story behind CVE-2026-48507 — an incorrect-authorization flaw in Snipe-IT where a low-privilege user could lock every admin out, found and disclosed by Voke Cyber. - [How We Found CVE-2026-42318 in GLPI](https://vokecyber.com/blog/cve-2026-42318-glpi-arbitrary-deletion): The story behind CVE-2026-42318 — an authorization bypass in GLPI, found by manual source review and responsibly disclosed by Voke Cyber. - [PCI DSS 4.0 Penetration Testing Requirements](https://vokecyber.com/blog/pci-dss-4-penetration-testing-requirements): What changed under PCI DSS 4.0 Requirement 11.4 — external/internal testing, segmentation validation, and what organizations must do now. - [EU AI Act Article 15: Adversarial Testing](https://vokecyber.com/blog/eu-ai-act-article-15-adversarial-testing): What Article 15 requires — adversarial testing, AI red-teaming, and Annex IV conformity evidence for high-risk AI systems before the August 2026 deadline. - [SOC 2 and Penetration Testing](https://vokecyber.com/blog/soc2-penetration-testing-requirements): How penetration testing fits into SOC 2 compliance, what auditors expect, and how to time your pentest for audit success. - [Why Charlotte Businesses Are Cyberattack Targets](https://vokecyber.com/blog/charlotte-businesses-cyberattack-targets): Why Charlotte, NC businesses face elevated cyber risk as the #2 banking center in the US. - [Penetration Testing vs. Vulnerability Assessment](https://vokecyber.com/blog/penetration-testing-vs-vulnerability-assessment): Detailed comparison of penetration testing and vulnerability assessments, differences in approach, depth, cost, and when to use each. - [What Is Penetration Testing?](https://vokecyber.com/blog/what-is-penetration-testing): A plain-English guide explaining what penetration testing is, how it works, what to expect, and how to know if your organization needs one. - [How Much Does a Penetration Test Cost?](https://vokecyber.com/blog/how-much-does-penetration-test-cost): Transparent pricing ranges by test type, factors that drive cost, and budgeting guidance for 2026. - [Penetration Testing Charlotte, NC](https://vokecyber.com/charlotte): Charlotte-area location page with services, local presence, and metro coverage. - [Resources](https://vokecyber.com/resources): Guides and educational content. - [Stakeholder Guide](https://vokecyber.com/resources/stakeholder-guide/): Guide for stakeholders on the penetration testing process. - [Pentest Remediation Playbook](https://vokecyber.com/resources/remediation-playbook/): Step-by-step fixes for the 30 most common internal penetration testing findings across Active Directory, network protocols, credentials, host security, and SSL/TLS. - [DNS Security Checklist (NIST 800-81r3)](https://vokecyber.com/resources/dns-security-checklist/): Free DNS security checklist aligned to NIST SP 800-81r3 — six areas to check, fix, and document. - [WebSocket Penetration Testing Guide](https://vokecyber.com/resources/websocket-security-testing-guide/): Complete methodology for testing WebSocket security — CSWSH, SQLMap over WebSockets, Socket.IO/SignalR testing, authorization bypass, and remediation with working code examples. - [Book a Call](https://vokecyber.com/book): Schedule a free 15-minute intro call to discuss penetration testing needs — no sales pitch. - [Healthcare Penetration Testing](https://vokecyber.com/services/healthcare): HIPAA-aligned penetration testing for healthcare organizations. - [FinTech Penetration Testing](https://vokecyber.com/services/fintech): Penetration testing for financial services and fintech companies. - [SaaS Penetration Testing](https://vokecyber.com/services/saas): Penetration testing for multi-tenant SaaS platforms. - [E-Commerce Penetration Testing](https://vokecyber.com/services/ecommerce): Penetration testing for online retail and e-commerce platforms. - [Manufacturing Penetration Testing](https://vokecyber.com/services/manufacturing): Penetration testing for manufacturing companies and OT environments. - [Education Penetration Testing](https://vokecyber.com/services/education): Penetration testing for schools, universities, and EdTech companies. ## Key Differentiators - Direct communication with the tester — no account managers or middlemen - Free retesting included with every engagement (30-day window) - Can start testing within 24 hours of contract signing - Transparent pricing with no unnecessary add-ons - Every tester has 5+ years of hands-on offensive security experience - US-based — all work performed domestically - Actionable reports with business impact and remediation guidance ## Certifications - OSCP — Offensive Security Certified Professional - OSWA — Offensive Security Web Assessor - CISSP — Certified Information Systems Security Professional - CCSK — Certificate of Cloud Security Knowledge ## Industries Served - Finance & FinTech - Healthcare - SaaS Platforms - E-Commerce - Manufacturing - Education ## Full Content For the complete, detailed content of every page on this site, see [llms-full.txt](https://vokecyber.com/llms-full.txt).