Published Vulnerability Research

Selected public findings across application trust boundaries and server resource consumption.

The 10 advisories below credit my research as djvirus9 or djvirus@yeswehack. Each entry links to the publisher’s description and acknowledgment. This is a selection of public work, rather than a complete inventory of assigned CVEs or private reports.

Scores are the publisher/CNA’s CVSS 3.1 assessment. Dates refer to publication of the CVE record. References checked on 10 September 2026.

Injection and unsafe content

  • Stored XSS through SVG uploads

    An authenticated user can upload active SVG content that executes when another user opens it in an executable browser context.

    Advisory & creditCVE record
  • CSV formula injection in position exports

    Attacker-controlled position fields reach a CSV export. Spreadsheet software may interpret these values as formulas when another user opens the file.

    Advisory & creditCVE record
  • XML injection in KML and GPX exports

    Device names are inserted into XML exports without the required escaping, allowing file structure manipulation and spoofed location content.

    Advisory & creditCVE record
  • HTML injection in notification emails

    Names controlled by a low-privilege user are inserted into notification HTML, enabling misleading content and phishing in emails to other users.

    Advisory & creditCVE record

Authorization and filesystem boundaries

  • OIDC authorization code theft through an open redirect

    Unvalidated redirect destinations in OIDC provider endpoints can send authorization codes to an attacker-controlled endpoint.

    Advisory & creditCVE record
  • Path traversal in device image storage

    An absolute device identifier can cause an image upload to write outside the configured media directory. Impact depends on the server’s filesystem permissions.

    Advisory & creditCVE record

Resource exhaustion

  • CPU exhaustion in MIME parameter parsing

    Excessive RFC 2231 MIME parameters in a message cause excessive CPU use during LMTP mail delivery. The vendor identifies this as a resource-consumption issue.

    Advisory & creditCVE record
  • Sieve CPU time limit bypass

    A user able to supply a Sieve script can cause processing to exceed the configured CPU time limit, degrading server performance.

    Advisory & creditCVE record
  • CPU exhaustion in IMAP THREAD processing

    A crafted message header causes disproportionate CPU use when a mail client requests message threading for the affected mailbox.

    Advisory & creditCVE record
  • Hash-collision CPU exhaustion in IMAP THREAD

    Crafted header values collide in an internal hash table. Message threading can exhaust CPU; the vendor identifies this as distinct from CVE-2026-40014.

    Advisory & creditCVE record

Research approach

I combine code review with evidence of reachability and impact, then work with maintainers through disclosure and remediation. Read my research methodology or the technical notes behind selected findings.

For platform profiles and Hall of Fame references, see Community & Recognition.