Public Vulnerability Advisories & Coordinated Disclosure

Verified CVE Disclosures & Security Research

Active offensive security research demonstrates the ability to discover zero-day and application-level vulnerabilities beyond signature-based scanning. All advisories below are publicly verifiable via the NIST National Vulnerability Database (NVD), MITRE CVE records, and Exploit-DB.

MITRE & NIST NVD Cataloged

Published CVE Vulnerability Records

Select any CVE identifier below to inspect its complete technical summary, CVSS v3.1 vector breakdown, potential business impact, and defensive remediation guidance.

CVE-2022-27927CVSS v3.1: 9.8 (CRITICAL)Published April 2022

Read Full Technical Advisory

Unauthenticated SQL Injection in Microfinance Management System v1.0

Microfinance Management System v1.0, when deployed with MySQL as its backend database, contains a critical SQL injection vulnerability in `/mims/updatecustomer.php`. User-controlled input passed through the `customer_number` (and/or `course_code`) parameter is concatenated directly into backend SQL statements without parameterized prepared statements or strict type casting, enabling remote attackers to alter query logic and execute arbitrary SQL commands.

NVD MITRE Exploit-DB Repository

Affected Software: Microfinance Management System v1.0 (PHP / MySQL)
Weakness Classification: CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2022-28079CVSS v3.1: 8.8 (HIGH)Published April 2022

Read Full Technical Advisory

SQL Injection Vulnerability in College Management System v1.0

College Management System v1.0 contains a high-severity SQL injection vulnerability via the `course_code` parameter. Insufficient input sanitization and lack of prepared statements allow an attacker with low-privileged access to inject arbitrary SQL syntax into backend database queries.

NVD MITRE Exploit-DB

Affected Software: College Management System v1.0
Weakness Classification: CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-28080CVSS v3.1: 8.8 (HIGH)Published April 2022

Read Full Technical Advisory

SQL Injection Vulnerability in Royal Event Management System v1.0

Royal Event Management System v1.0 is vulnerable to SQL injection via the `todate` parameter. Because date-filtering input is concatenated directly into SQL queries without strict date parsing or prepared statements, an attacker can manipulate query execution against the backend database.

NVD MITRE Exploit-DB

Affected Software: Royal Event Management System v1.0
Weakness Classification: CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

National Aeronautics and Space Administration (NASA)•November 2024

NASA Vulnerability Disclosure Program (VDP) Hall of Fame Recognition

Officially recognized in NASA's Vulnerability Disclosure Program (VDP) Hall of Fame for independently identifying and responsibly reporting security vulnerabilities to help protect NASA's digital infrastructure and information systems.

Conducted independent security research in strict compliance with NASA's Vulnerability Disclosure Policy rules of engagement.
Reported validated technical findings through NASA's authorized coordinated disclosure workflow, enabling remediation without exposing sensitive operational details.
Acknowledged by NASA's Senior Agency Information Security Officer / VDP recognition ledger on Eren Gözaydın's verified professional record.

Accuracy Note: This recognition reflects independent, good-faith vulnerability research acknowledged under NASA's public Vulnerability Disclosure Program (VDP), not a commercial consulting contract or employment engagement with NASA.

Primary Portfolio Record (erengozaydin.com)NASA Vulnerability Disclosure Policy (Bugcrowd Program Overview)

Engagement Scoping

Discuss Your Security Testing Requirements

Tell me what you need assessed—whether a multi-tenant web application, REST/GraphQL API, Android/iOS mobile build, or internal Active Directory environment. You will deal directly with the senior specialist executing the assessment.

• Direct Senior Execution• Mutual NDA Available• Reproducible PoC Reporting• Post-Remediation Retesting

Discuss Your Project View Credentials & Verification eren@erengozaydin.com