Back to findings
Break
All findings.
Bugs I found, explained simply. I keep the cause and the fix, and leave out anything related to internal or company data. Some of these get walked through on YouTube too.
sqli
SQL injection that writes its way to code execution
Jan 2026
xss
DOM XSS through postMessage
Dec 2025
web
A loose regex to auth bypass, then SQL injection to admin
Jul 2025
auth
A hardcoded SAML signing key, and logging in as anyone
Feb 2025
xss
Stored XSS to RCE, and why 'self-XSS' wasn't self at all
Jan 2025
windows
A SYSTEM service that loaded a DLL from a world-writable folder
Oct 2024
auth
Account takeover through an unthrottled TOTP check
Apr 2024
web