tonysec

Available for immediate withdrawal€4,155

Professional Bio

Crafting your researcher identity starts here. Edit your settings to add a bio.

Documented

Writeups

Cheatsheets

Tools

Featured Content

SQL Injection (CWE-89) PRO

Academy

SQL Injection on api.target.example through /api/v1/projects via POST parameter "tableName" leads to Remote Code Execution (RCE)

Pre-authenticated Remote Code Execution on POST /api/v1/projects via a stacked SQL injection in the JSON field tableName (interpolated by String.format into the FROM clause), abusing PgJDBC's multi-statement handling and a PostgreSQL superuser role to invoke COPY ... TO PROGRAM and run arbitrary OS commands as the postgres user.

pyus3r

829

May 20, 2026

CVSS10

€705

Cross-site Scripting (XSS) - Reflected (CWE-79)FREE

Academy

Escalating a Reflected XSS to High Severity via Filter Bypass and Cache-Assisted Delivery

Generic XSS caused by improper handling of user-controlled input in the URL path

tonysec

434

Apr 22, 2026

CVSS7.2

€600

Acceptance of Extraneous Untrusted Data With Trusted Data - Cache Poisoning (CWE-349)FREE

Academy

A PortSwigger-lab-style cache poisoning → pre-auth ATO with a single request

PortSwigger-lab-style cache poisoning via Referer + Akamai WAF bypass → zero-interaction ATO

tonysec

260

May 30, 2026

CVSS9.3

€1,100

LogicalBreach Academy

tonysec

Professional Bio

Featured Content

SQL Injection on api.target.example through /api/v1/projects via POST parameter "tableName" leads to Remote Code Execution (RCE)

Escalating a Reflected XSS to High Severity via Filter Bypass and Cache-Assisted Delivery

A PortSwigger-lab-style cache poisoning → pre-auth ATO with a single request