185 - Facebook Account Takeovers and a vBulletin RCE

Is it possible to escalate a self-XSS into an account takeover? Perhaps, we take a look at some potential options by abusing single-sign on. Then we take a look at a few Facebook/Meta authentication issues, and a deserialization trick to increase the usable classes in PHP.

abusing account account takeover authentication bounty-podcast deserialization facebook hash-import-2023-02-16-04-52 meta options php podcast rce sign single takeover takeovers vbulletin xss