About me

About me

I am Adrian Junge (vurlo). I started programming in school, and back then I could not have imagined how deep that rabbit hole would go. I first became interested in algorithms through competitive programming and solving problems on LeetCode. Over time that problem-solving curiosity pulled me further into cybersecurity. Today I study computer science at KIT Karlsruhe Institute of Technology with a focus on cybersecurity and play CTFs as part of KITCTF, the university's CTF team. Alongside my studies, I worked as a research assistant and working student at Fraunhofer IOSB, 1&1 Mail & Media, and FZI Forschungszentrum für Informatik. Lately, I have been digging deeper into bug bounty hunting, coordinated disclosure, and CVE disclosures.

This page is meant as a record of what I have worked on and learned from: reproduced bugs, writeups, disclosures, certificates, and a few milestones along the way.

27 CVEs
4 Bug bounties
2 Created CTF Challenges 1 Certificates 5 Talks 10 Achievements

CVEs

27 entries

SuiteCRM

SuiteCRM CVE-2026-97377 CWE-89 SQL injection through the legacy SOAP portal_get_entry_list method
Details

Summary

A low-privileged portal API context could pass SQL expressions through the where and order_by inputs of portal_get_entry_list. Insufficient sanitization during query construction allowed blind extraction of database metadata and potentially sensitive data. Depending on the query context and database permissions, an attacker could also manipulate data or degrade performance with complex queries. On MySQL installations with FILE privilege, SELECT INTO OUTFILE could potentially lead to code execution.

References

Disclosure timeline

  1. Reported the vulnerability to SuiteCRM.
  2. Report acknowledged by SuiteCRM.
  3. Report accepted by SuiteCRM.
  4. Fixing SuiteCRM 7.15.2 and 8.10.2 releases published.
  5. CVE assigned.
  6. Security advisory publication pending.

FFmpeg

High FFmpeg CVE-2026-70632 CWE-787 Heap out-of-bounds write in the CFHD decoder via AVI demuxing
Details

Summary

FFmpeg 4.4 through versions before 9.0 failed to enforce the CFHD transform-type-2 output-width invariant. A crafted AVI file could make reconstruction write oversized sample rows beyond the output frame, enabling heap corruption and potentially arbitrary code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-70628 CWE-190 CWE-787 DVB subtitle parser heap buffer overflow via WTV file
Details

Summary

FFmpeg 0.5 through versions before 9.0 contained a signed integer overflow in the DVB subtitle parser. A crafted WTV file could wrap the capacity check and make memcpy() write attacker-controlled data beyond a heap buffer, potentially causing memory corruption or code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

Moderate FFmpeg CVE-2026-70629 CWE-908 Uninitialized heap memory read in the RSCC decoder
Details

Summary

FFmpeg 3.0 through versions before 9.0 failed to validate that an RSCC tile decompressed to its declared size. The decoder could copy the unwritten suffix of a persistent heap buffer into the output frame, disclosing data from prior allocations or previously decoded frames.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

Moderate FFmpeg CVE-2026-70630 CWE-908 Uninitialized heap memory read in the Screenpresso decoder
Details

Summary

FFmpeg 3.0 through versions before 9.0 did not verify that an SPV1 packet's Zlib stream produced a complete frame. Copying the full dimensions from the partially written persistent buffer could expose stale heap contents from earlier allocations or frames.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

Moderate FFmpeg CVE-2026-70631 CWE-908 Uninitialized heap memory read in the TIFF decoder
Details

Summary

FFmpeg 0.5 through versions before 9.0 copied every declared TIFF strip row even when Deflate produced fewer bytes than required. The decoded image could consequently contain unwritten bytes holding sensitive data from prior heap allocations.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

SuiteCRM

High SuiteCRM CVE-2026-69142 CWE-89 Authenticated SQL injection in the map_markers distance parameter
Details

Summary

SuiteCRM through 7.15.1 and 8.10.1 inserted the authenticated map marker endpoint's distance parameter into a SQL expression without numeric validation or parameterization. Attackers could use blind SQL injection to extract or manipulate database data and, with sufficiently privileged MySQL deployments, potentially execute code through SELECT INTO OUTFILE.

References

Disclosure timeline

  1. Reported the vulnerability to SuiteCRM.
  2. Report acknowledged by SuiteCRM.
  3. Report accepted by SuiteCRM.
  4. Fixing SuiteCRM 7.15.2 and 8.10.2 releases published.
  5. CVE assigned and security advisory published.

FFmpeg

High FFmpeg CVE-2026-66037 CWE-770 Uncontrolled resource consumption in the IAMF demuxer
Details

Summary

FFmpeg through 8.1.2 trusted an attacker-controlled count_label value before checking the available IAMF OBU data. A 17-byte input could consequently trigger a multi-gigabyte allocation during format probing, exhausting process memory or causing an OOM kill.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-66038 CWE-908 Uninitialized memory disclosure in the LCL/Zlib video decoder
Details

Summary

FFmpeg through 8.1.2 treated a short Zlib decompression as non-fatal in the LCL video decoder. The RGB24 conversion path could then copy uninitialized heap contents into the output frame, potentially exposing allocator data and weakening ASLR in long-lived media services.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-66039 CWE-190 CWE-122 Integer overflow and heap out-of-bounds write in the MACE6 decoder
Details

Summary

FFmpeg through 8.1.2 could overflow the MACE6 output sample-count calculation when decoding a crafted CAF file. This produced an undersized allocation followed by a heap out-of-bounds write, potentially causing memory corruption, a crash, or code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-66040 CWE-122 Heap out-of-bounds write in the PNG and APNG eXIf encoder
Details

Summary

FFmpeg through 8.1.2 could underestimate the space required to serialize a crafted PNG eXIf chunk whose IFD entries reused a large value payload. Canonical serialization could then expand beyond the allocation and cause deterministic heap corruption, a crash, or potential code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-66036 CWE-122 Heap out-of-bounds write in the vf_hqdn3d video filter
Details

Summary

FFmpeg through 8.1.2 allocated vf_hqdn3d line-history buffers using the initial frame dimensions. If a crafted video increased its resolution while filtergraph reinitialization was disabled, denoise_spatial() could write beyond those undersized buffers and corrupt heap memory.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-66041 CWE-787 Heap out-of-bounds write in the vf_quirc video filter
Details

Summary

FFmpeg 7.0 through 8.1.2 did not resize the vf_quirc grayscale buffer when input dimensions changed. A crafted PGS/SUP subtitle whose second presentation was larger than its first could therefore overflow the initial allocation and cause heap corruption, a crash, or potential code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-65703 CWE-787 Out-of-bounds write in the TDSC video decoder
Details

Summary

FFmpeg 2.7 through 8.1.2 reused an undersized reference frame when a crafted AVI file changed dimensions between TDSF frames. The TDSC decoder could consequently write attacker-controlled pixel data beyond the frame buffer, causing heap corruption, a crash, or potential code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-65704 CWE-787 CWE-191 Out-of-bounds write via the TY demuxer and Shorten decoder
Details

Summary

FFmpeg through 8.1.2 could underflow a packet size while processing a crafted ffconcat file with the -safe 0 flag. The negative size reached memcpy() in the Shorten decoder as a near-SIZE_MAX value, causing out-of-bounds reads and writes, heap corruption, and a potential crash or code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-65705 CWE-787 CWE-131 Out-of-bounds write in the vf_floodfill video filter
Details

Summary

FFmpeg 3.4 through 8.1.2 sized the vf_floodfill traversal stack from the initial frame dimensions. If a later frame was larger while filtergraph reinitialization was disabled, the filter could push points beyond that allocation, corrupting heap memory and potentially causing a crash or code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High FFmpeg CVE-2026-65706 CWE-787 CWE-131 Out-of-bounds write in the vf_swaprect video filter
Details

Summary

FFmpeg 3.0 through 8.1.2 reused a temporary row buffer sized for a one-byte pixel step across every image plane. Processing an odd-width NV12 frame could therefore copy past the heap allocation for its interleaved chroma plane, causing memory corruption, a crash, or potential code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

Joomla CMS

Moderate Joomla CMS CVE-2026-35221 CWE-89 Blog post Authenticated blind SQL injection in com_finder 16 min read
Details

Summary

Joomla CMS 5.4.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by improperly constructed filter clauses in the com_finder search query. Authenticated attackers could influence the SQL query and infer database contents through blind SQL injection.

References

Disclosure timeline

  1. Reported to the Joomla Security Strike Team.
  2. First acknowledgment.
  3. Confirmation of the issue and initial patch development.
  4. Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

Joomla CMS

Moderate Joomla CMS CVE-2026-35222 CWE-89 Blog post Authenticated blind SQL injection in com_tags 16 min read
Details

Summary

Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by improper validation of order clauses in com_tags. Authenticated attackers could manipulate generated SQL and infer database contents through blind SQL injection.

References

Disclosure timeline

  1. Reported to the Joomla Security Strike Team.
  2. First acknowledgment.
  3. Confirmation of the issue and initial patch development.
  4. Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

Joomla CMS

High Joomla CMS CVE-2026-48898 CWE-284 Privilege escalation through com_users batch task
Details

Summary

Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by an improper access check in the com_users batch task. Authenticated attackers could abuse the batch flow to escalate privileges.

References

Disclosure timeline

  1. Reported to the Joomla Security Strike Team.
  2. Confirmation of the issue and initial patch development.
  3. Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

ChurchCRM

High ChurchCRM CVE-2026-39329 CWE-89 Authenticated blind SQL injection in EventNames.php
Details

Summary

In ChurchCRM 7.0.5, event-name management in EventNames.php exposed SQL injection behavior to authenticated users with access to the affected configuration path. Successful exploitation could expose or modify ChurchCRM database records.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High ChurchCRM CVE-2026-39319 CWE-89 Second-order SQL injection via FundRaiserEditor.php
Details

Summary

ChurchCRM 7.1.2 and earlier allowed stored input from FundRaiserEditor.php to become executable SQL later in the fundraiser workflow. This second-order SQL injection could lead to database compromise once the malicious stored value was processed.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High ChurchCRM CVE-2026-39327 CWE-89 Authenticated SQL injection in MemberRoleChange.php
Details

Summary

In ChurchCRM 7.0.5, authenticated users with group and role management privileges could inject SQL through the MemberRoleChange.php role update flow. Depending on deployment configuration, this could provide database read/write access and potential privilege escalation.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High ChurchCRM CVE-2026-39330 CWE-89 Authenticated blind SQL injection in PropertyAssign.php
Details

Summary

In ChurchCRM 7.0.5, property assignment handling in PropertyAssign.php exposed a blind SQL injection path for authenticated users. Attackers could infer database contents and potentially alter application data through injected SQL.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High ChurchCRM CVE-2026-39326 CWE-89 Authenticated blind SQL injection in PropertyTypeEditor.php
Details

Summary

In ChurchCRM 7.0.5, property type editing in PropertyTypeEditor.php accepted authenticated input that could influence SQL statements. The issue could lead to database compromise, including data extraction or modification.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High ChurchCRM CVE-2026-39334 CWE-89 Authenticated blind SQL injection in SettingsIndividual.php
Details

Summary

In ChurchCRM 7.0.5, settings input handled by SettingsIndividual.php could be used by an authenticated user to influence a SQL query. The issue enabled blind SQL injection behavior that could expose sensitive database contents.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High ChurchCRM CVE-2026-39325 CWE-89 Authenticated blind SQL injection in SettingsUser.php
Details

Summary

In ChurchCRM 7.0.5, user settings handling in SettingsUser.php exposed an authenticated blind SQL injection path. Attackers could infer and extract database data through timing-based or boolean blind SQL techniques.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

Created CTF Challenges

2 challenges

Scanwich Station

Hard Web Pwn GPNCTF 2026 CTF writeup 14 min read
Details

Summary

Hybrid web and pwn challenge about mass assignment, QR-code decoding, signed integer overflow, and GLIBC dynamic symbol poisoning. Published for GPNCTF 2026.

Timeline

  1. Published at GPNCTF 2026.

Smile at me

Hard Web GPNCTF 2025 CTF writeup 11 min read
Details

Summary

Web challenge about URL parser differentials, strict CSP, and an XS-Leak using Scroll-to-Text Fragment behavior with lazy-loaded images. Published for GPNCTF 2025.

Timeline

  1. Published at GPNCTF 2025.

Certificates

1 certificate

Hack The Box Certified Penetration Testing Specialist

Penetration Testing Certificate Blog post 8 min read
Details

Summary

Completed the HTB CPTS path and passed the practical exam on the first attempt, including a full penetration-test report for the exam environment. The work focused on disciplined enumeration, Active Directory attack paths, web findings, and reproducible reporting.

Timeline

  1. Start of the HTB CPTS path.
  2. Completed the HTB CPTS path and started the practical exam.
  3. Passed the practical exam and earned the HTB CPTS certificate.

Talks

5 talks

Teaching AI to hack Joomla so I can skip my homework

Web Joomla CMS Slides
Details

Summary

How a manual SQLi hunt turned into an AI-assisted Joomla audit and multiple assigned CVEs for a university course.

Timeline

  1. Upcoming Talk at BSides Munich.
  2. Talk at the OWASP Stammtisch Karlsruhe.
  3. Final presentation for the course.
  4. Talk at KITCTF.

KITCTF Web Intro

Web Slides KITCTF
Details

Summary

Introductory web security talk for KITCTF.

Timeline

  1. Talk at KITCTF.

Relevant achievements

10 events

KITCTF

CTF Team KITCTF
Details

Summary

Selected KITCTF team results across international CTFs and finals qualifiers.

Timeline

  1. KITCTF #3 at GlacierCTF 2025 #3 at GlacierCTF.
  2. FluxKITtens #6 at Google CTF 2025 #6 at Google CTF as the FluxKITtens merger team (FluxFingers and KITCTF), qualifying for the Hackceler8 finals in Mexico.
  3. KITCTF #3 at SwampCTF 2025 #3 at SwampCTF.
  4. KITCTF at SnakeCTF 2024 finals Qualified for and participated in the SnakeCTF finals in Italy.
  5. KITCTF #3 at GlacierCTF 2024 #3 at GlacierCTF, qualifying for DHM 2025 as KITCTF team.

DHM

CTF Competition DHM
Details

Summary

Deutsche Hacking Meisterschaft (CSCG finals).

Timeline

  1. DHM 2025 participation Participated in the DHM finals.
  2. DHM 2024 #1 Placed #1 in the DHM finals.

CSCG

CTF Competition CSCG
Details

Summary

Cyber Security Challenges Germany: Qualified for DHM in 2024 and 2025.

Timeline

  1. CSCG 2025 top 10 global & DHM qualification Qualified for DHM again and finished top 10 globally.
  2. CSCG 2024 DHM qualification Qualified for DHM through CSCG.

Search