cvargas.com

Offensive security · Remote, Colombia

Cristian
Vargas

Offensive Application Security Engineer
at Fluid Attacks

Finding vulnerabilities in software people depend on, like NestJS, Fastify, DOMPurify and Ghost.

Cristian Vargas depicted as a pixel-art vulnerability hunter
THE VULNERABILITY HUNTER

Research archive11 ENTRIES

CVEs & Advisories · Bestiary

Real software. Disclosed vulnerabilities. Research you can verify.

Featured discoveryHigh · 8.2

CVE-2026-2293

NestJS

Auth/authz bypass via path normalization (lack of data validation)

Auth bypass / netonRead advisory
Disclosure indexCVSS 4.0
Disclosed vulnerabilities, affected products, vulnerability classes and severity scores
ID / AdvisoryProductClassSeverity
CVE-2025-10655 FrappeHelpdesk 1.14.0
SQLi

SQL injection (get_dashboard_data filters.team)

 8.6 High
CVE-2026-2293 NestJS11.1.13 (fixed 11.1.14)
Auth bypass

Auth/authz bypass via path normalization (lack of data validation)

 8.2 High
CVE-2026-2880 @fastify/middie9.1.0 (fixed 9.2.0)
Auth bypass

Improper path normalization (middleware bypass)

 8.2 High
CVE-2025-11461 FrappeCRM 1.53.1 (fixed 1.54.0)
SQLi

SQL injection (multiple, dashboard controller)

 7.1 High
CVE-2025-10692 OpenSupports4.11.0
SQLi

SQL injection (staff get-new-tickets)

 7.1 High
CVE-2025-10696 OpenSupports4.11.0
IDOR

IDOR (supervised list, cross-user ticket disclosure)

 7.1 High
Explore all 11 disclosures
Additional disclosed vulnerabilities
ID / AdvisoryProductClassSeverity
CVE-2025-10695OpenSupports4.11.0
SSRF

Unauthenticated SSRF (test-imap/test-smtp)

6.9 Medium
CVE-2025-9960is-localhost-ip2.0.0
SSRF

SSRF via restrictions bypass

6.9 Medium
CVE-2025-9862Ghost6.0.6 (5.99.0–5.130.3, 6.0.0–6.0.8; fixed 5.130.4/6.0.9)
SSRF

SSRF via oEmbed bookmark

6.1 Medium
CVE-2026-0540co-foundDOMPurify3.1.3–3.3.1 (fixed 3.3.2)
XSS

DOM-based XSS (mXSS via re-contextualization)

5.3 Medium
CVE-2025-15056Quill2.0.3
XSS

XSS in HTML export (formula/video formats)

5.1 Medium
Competition record

Awards · Trophies

CTF and cyber competition results.

Featured achievement

1st · OAS Cyber Americas Cup

2026 · with Fluid Attacks

  • 1st · Kaspersky CTF — NA/SA/Caribbean

    2026 · qualified SAS CTF final, Bali · Fluid Attacks

  • 1st · Ekoparty CTF ×2

    2025–2026 · consecutive · Fluid Attacks

  • 1st · DragonJAR CTF

    2025

  • 2nd · DragonJAR CTF

    2026

  • Fluid Attacks CTF: Hall of Fame #1 · 1st Ed.1 · 2nd Ed.2

    LATAM Challenge · individual · cvargas

Articles & field notes

Writing · Grimoire

Research, secure code review and lessons from the field.

Featured Write-up · EN

HTTP Verb Tampering in NestJS: Bypassing Middleware with HEAD Requests

Read article

All writing →

Talks & conversations

Talks · Transmissions

AppSec conversations, practical workflows and certification journeys.

Featured talk · ES / 2026

Codex aplicado al AppSec

Fluid Attacks · Meetup LATAM Febrero 2026

Watch talk
Character sheet

Skills · Attributes

Self-assessed, 1–10. Evidence alongside each attribute.

  • Web8/1011 CVEs · OSWE · CWEE · BSCP
  • Mobile8/10eMAPT
  • Research7/10Fluid Attacks advisories
  • AI9/10C-AI/MLPen · C-AgAIPen · Talk: Codex aplicado al AppSec
  • Cloud7/10CCSP-AWS
  • Binary Exploitation3/10
  • Crypto2/10
Credentials

Certifications · Relics

Offensive web and AppSec certifications.

Inventory · 12 more

Contact · Save Room

A good place to
start a conversation.

For research, talks or disclosure coordination, reach out on LinkedIn.

Let’s connect on LinkedIn