Bug Hunter

Al Baradi Joy

Cybersecurity Researcher & Ethical Hacker

Independent security researcher hunting bugs across Bug Bounty Programs and Responsible Disclosure programs worldwide. Recognised by NASA, WHO, and the U.S. GSA for uncovering critical vulnerabilities — from CVE research on Exploit-DB to private BBP payouts on HackerOne and Bugcrowd.

Active on
HackerOne Bugcrowd
HackerDNA · Leaderboard
#1
BANGLADESH 🇧🇩
VERIFIED · ALL-TIME
Al Baradi Joy
ABJ · RESEARCHER · 2025 ▮
01 //

Hall of Fame

World Health Organisation
Hall of Fame
NASA
Letter of Recognition
GSA
U.S. Gen. Services Admin
ABB
Hall of Fame
Ollyo
Hall of Fame
Arlo
Hall of Fame
Pornhub
Hall of Fame
UK Hydrographic Office
Hall of Fame
UK Government
Hall of Fame
Scotland Government
Hall of Fame
02 //

Published Exploits

CVE-2025-2563
EDB-ID: 52137
2025-04-07 · webapps
WordPress User Registration & Membership ≤ 4.1.1 — Unauthenticated Privilege Escalation
Unauthenticated attackers can escalate to administrator role. Affects the User Registration & Membership plugin for WordPress via improper privilege management (CWE-269).
9.8
CVSS
CRITICAL
CVE-2025-24893
EDB-ID: 52136
2025-04-07 · webapps
XWiki Platform 15.10.10 — Remote Code Execution
Any guest user can execute arbitrary code remotely via the SolrSearch endpoint, leading to full server compromise. Patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1.
9.8
CVSS
CRITICAL
CVE-2025-31131
EDB-ID: 52135
2025-04-07 · webapps
YesWiki < 4.5.2 — Unauthenticated Path Traversal (LFI)
Unauthenticated path traversal via the 'squelette' parameter allows reading arbitrary files such as /etc/passwd. Affects YesWiki versions before 4.5.2.
8.6
CVSS
HIGH
CVE-2025-24813
EDB-ID: 52134
2025-04-07 · webapps
Apache Tomcat 11.0.3 — Remote Code Execution
Path Equivalence RCE via partial PUT deserialization. Attacker uploads a serialized Java gadget payload, then triggers it via GET with a crafted JSESSIONID cookie. Affects Tomcat < 11.0.3 / 10.1.35 / 9.0.98.
9.8
CVSS
CRITICAL
CVE-2024-8856
EDB-ID: 52131
2025-04-06 · webapps
WP Time Capsule (Backup & Staging) ≤ 1.21.16 — Unauthenticated Arbitrary File Upload to RCE
Unauthenticated attackers can upload arbitrary files via upload.php. Uploading a PHP file allows direct remote code execution from the plugin's bridge directory.
9.9
CVSS
CRITICAL
CVE-2024-1234
EDB-ID: 52126
2025-04-05 · webapps
Exclusive Addons for Elementor ≤ 2.6.9 — Authenticated Stored XSS
Contributor-level users can inject persistent JavaScript via the 's' parameter due to insufficient input sanitization and output escaping in the Elementor plugin.
6.5
CVSS
MEDIUM
03 //

Contact

bash — secure_channel.sh · 256-bit encrypted