I'm an Offensive Security Researcher and Bug Bounty Hunter focused on web application security and source-code auditing of open-source software. I find vulnerabilities, confirm them with working PoCs, and report through coordinated / responsible disclosure — often contributing the fix as a PR.
- 🔭 Auditing open-source web apps (PHP / Python / JavaScript)
- 🛡️ Specializing in: XSS, SQL Injection, SSRF, LFI, Path Traversal, Broken Access Control, CSRF, Auth Bypass
- 🐛 Bug Bounty: Okta (Bugcrowd), Anthropic (HackerOne), Agoda
- 🎓 B.Sc. Computer Engineering — Fergana State Technical University (2020–2025)
- 🌍 Based in Uzbekistan (UTC +05:00)
- 🏆 Leantime Contributor — 5 security PRs submitted to Leantime OSS
- 📡 CVE via: VulnCheck CNA — 4 Published + 1 VulnCheck Verified
"The quieter you become, the more you are able to hear."
🏆 ADVISORIES & CVEs — 4 PUBLISHED · 1 VulnCheck Verified · 9 Withdrawn ▼
| # | CVE | Product | Type | CVSS |
|---|---|---|---|---|
| 1 | CVE-2026-66412 | Leantime ⭐10k+ | IDOR (getMilestone) | 7.5 |
| 2 | CVE-2026-66414 | Leantime ⭐10k+ | Open Redirect | 6.1 |
| 3 | CVE-2026-66415 | Leantime ⭐10k+ | SSRF + LFI | 8.8 |
| 4 | CVE-2026-66416 | Leantime ⭐10k+ | CSRF Disabled | 8.8 |
| GHSA | Type | CVSS | Internal | Why withdrawn |
|---|---|---|---|---|
| GHSA-xq73-pwv7-jcvg | Unauth SQLi (GeneratePassword) | 9.8 | SCRMBT-480 | Payload escaped in retrieve_user_id(); INSERT unreachable (MySQL general log) |
| GHSA-m4vv-h45q-rvvf | File Upload Case Bypass | 8.8 | SCRMBT-481 | strtolower() applied since 2020; files stored under GUID name |
| GHSA-w59p-wvpf-gmm5 | File Upload GD Bypass RCE | 8.8 | SCRMBT-482 | Content regex runs before GD check; GD-missing returns false since 7.11.x |
| GHSA-h87x-44w6-3q7f | Unauth XSS (WebToLead) | 8.2 | SCRMBT-483 | voku AntiXSS strips on* / javascript: (live tested, 8 payload classes) |
All 4 were re-verified against a live SuiteCRM 7.15.1 instance — withdrawn honestly to preserve trust with SuiteCRM and VulnCheck.
| # | Target | Type | CVSS |
|---|---|---|---|
| 1 | OzonTech file.d | Unauth Mgmt API (:9000) | 8.2 |
file.d live-verified 2026-08-13 (built + run + unauthenticated curl evidence on all claimed endpoints) — defending with corrected technical write-up.
| Target | Type | CVSS | Why |
|---|---|---|---|
| eGov SmartCity | Struts2 RCE | 10.0 | S2-045/046 don't affect 2.5.14.1; S2-057 = existing CVE-2018-11776 |
| Tesla Vehicle CMD | JWT No Verify | 8.8 | By design: fleet API verifies token — forged JWT → 401 (live tested) |
| Gojek Darkroom | Path Traversal | 7.5 | mux cleanPath 301-blocks ../ (live tested) |
| Kaspersky KLara | No Rate Limit | 6.5 | Hardening gap, not CVE-worthy |
Building a safer open-source ecosystem, one vulnerability at a time.
🏆 GITHUB ACHIEVEMENTS — click to expand ▼
📊 GITHUB STATS — click to expand ▼
🔥 WAKATIME (LAST 30 DAYS) — click to expand ▼
📈 CONTRIBUTION ACTIVITY — click to expand ▼