Thales Suspicious
Remote code execution through nested attachment path traversal.
My research.
A selection of vulnerabilities I’ve reported, my bug bounty profile, and conversations about the work.
YesWeHack
Top 25.
I hunt alongside my day job, mostly with my hunter squad.
I’ve submitted 500+ bug bounty reports across platforms.
Public disclosures.
The public advisories for vulnerabilities I’ve reported.
Mozilla PDF.js
Arbitrary JavaScript execution.
Open WebUI
Server-side request forgery in the RAG web search feature.
Kiteworks Secure Data Forms
Reflected cross-site scripting.
Kiteworks Secure Data Forms
Reflected cross-site scripting.
Talking bug bounty.
I talked with YesWeHack about hunting alongside my day job, a favourite discovery that turned out to be a duplicate, and learning to use AI.