CVE-2024-45163
Critical
Disclosed
Remote Unauthenticated Denial of Service in Mirai Botnet C&C Server
I discovered a vulnerability in the Mirai botnet's command and control server that lets any remote, unauthenticated attacker take the C&C process down. The server mishandles simultaneous TCP connections: unauthenticated sessions are never closed, so an attacker who opens connections and sends a recognized username or arbitrary data drives the server into resource exhaustion. This effectively creates a "kill switch" for active Mirai C&C hosts. The finding was shared with global law enforcement agencies, enabling them to remotely disable malicious C&C infrastructure without needing to compromise or seize the servers directly.
CVE-2024-44809
Critical
Published
Remote Code Execution in the Raspberry Pi Camera Project
A remote code execution vulnerability in the Pi Camera project (version 1.0, maintained by RECANTHA) let an unauthenticated attacker run arbitrary commands on the host. The tilt.php script passed the "position" GET parameter into a system call without sanitizing it, so crafted input containing shell metacharacters executed with the privileges of the web server user. Anything exposed to an untrusted network was trivially exploitable. NVD scores it 9.8 Critical (CVSS 3.1).
CVE-2024-44808
Critical
Published
Remote Code Execution in the Vypor Attack API System
I found a remote code execution flaw in Vypor Attack API System v1.0. The application passed the "user" GET parameter straight into command execution without validating it, so a remote attacker with no credentials could run arbitrary code on the host. I published the technical write-up and the finding was assigned CVE-2024-44808, scored 9.8 Critical (CVSS 3.1) by NVD.
CVE-2024-48396
Medium
Patched
Reflected Cross-Site Scripting in AIML Chatbot
AIML Chatbot 1.0 failed to sanitize the message input field, so HTML or JavaScript sent to the bot was reflected back and executed in the victim's browser. An attacker could use it to run script in the context of the application, steal session data, or deface the chat interface. I reported it to the maintainer and the issue was fixed in version 2.0. NVD scores it 6.1 Medium (CVSS 3.1).
CVE-2026-42626
Medium
Published
Persistent Denial of Service in HP ENVY 5000 Printer Firmware
HP ENVY 5000 series printers running firmware VERBASPP1N003.2237A.00 put no timeout and no concurrent session limit on port 9100, the raw JetDirect printing port. An unauthenticated attacker on the same network can open a connection, hold it with keep-alive packets, and leave the printer's session threads locked in a waiting state. The printer stops accepting print jobs and stops responding to commands, and only a manual power cycle brings it back. The attack can be restarted the moment the device recovers. NVD scores it 5.9 Medium (CVSS 3.1).
Roblox Platform
Medium
Patched
Responsible Disclosure to Roblox
I identified and reported a security vulnerability in the Roblox platform through their responsible disclosure program. The issue was acknowledged by their security team and patched in a subsequent release. Per the program's terms, specific technical details remain under the platform's disclosure guidelines.
Fortune 500 Company
High
Confidential
High-Severity Vulnerability Under NDA
A high-severity vulnerability was discovered and reported to a Fortune 500 company through a private engagement. The details of this finding, including the affected product and technical specifics, are covered under a non-disclosure agreement. The issue has been resolved.