Skip to content
View wvllxe's full-sized avatar
3 followers · 2 following

Block or report wvllxe

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
wvllxe/README.md

typing banner

LinkedIn Email profile views

👋 About

Offensive security specialist focused on Web Application Security, Network Penetration Testing, and Red Team Operations. I find and responsibly disclose vulnerabilities, build proof-of-concept exploits, and teach the craft.

🧾 Published CVEs

# CVE ID Product Vulnerability Class CVSS PoC
1 CVE‑2026‑100520 Laranode < 1.2.1 Path Traversal → RCE (CWE-22) PoC
2 CVE‑2026‑104051 PictShare < 3.7.1 Sensitive Info Disclosure (CWE-522) PoC
3 CVE‑2026‑104356 PictShare < 3.7.1 Predictable Token / Weak PRNG (CWE-338) PoC
4 CVE‑2026‑104991 Phproject <= 1.8.6 Broken Object-Level Authorization / IDOR (CWE-862) PoC
5 CVE‑2026‑104905 FacturaScripts <= 2026.66 PHP Object Injection → Arbitrary File Deletion (CWE-502) PoC

CVSS 3.1 base scores.

🧰 Arsenal

Languages

Python Bash PHP Go

Tooling

Burp Suite Nmap sqlmap nuclei Kali Linux

Focus Areas

OWASP Top 10 · Source Code Audit · IDOR / BOLA · Auth Bypass · SQL Injection · SSRF · API Security · PHP Object Injection

Popular repositories Loading

  1. CVE-2026-100520-laranode-path-traversal CVE-2026-100520-laranode-path-traversal Public

    Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.

    Python 4 1

  2. CVE-2026-104051-pictshare-info-disclosure CVE-2026-104051-pictshare-info-disclosure Public

    Sensitive info disclosure via info API in PictShare < 3.7.1 (CWE-522). PoC + advisory writeup.

    Python 2

  3. CVE-2026-104356-pictshare-weak-delete-code CVE-2026-104356-pictshare-weak-delete-code Public

    Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.

    PHP 2

  4. CVE-2026-104905-facturascripts-object-injection CVE-2026-104905-facturascripts-object-injection Public

    PHP Object Injection -> Arbitrary File Deletion in FacturaScripts <= 2026.66 (CWE-502). PoC + advisory.

    PHP 1

  5. wvllxe wvllxe Public

    Security researcher — CVE hunter. Profile.

  6. CVE-2026-104991 CVE-2026-104991 Public

    CVE-2026-104991 — Missing Authorization (BOLA/IDOR) in Phproject REST API read/comment endpoints

    PHP