Matei "Mal" Badanoiu (aka CVE Jesus)

Pentest-Tools.com, Security Research Lead

Full time security researcher living his life one CVE at a time. Will need to find a new way to measure time if CVEs are not a thing anymore.

Matei "Mal" Badanoiu (aka CVE Jesus)

Full time security researcher living his life one CVE at a time. Will need to find a new way to measure time if CVEs are not a thing anymore.

Posts by this author

Security research
DotNetNuke: XSS to RCE (CVE-2026-40321)
DotNetNuke (DNN) might be a leading CMS in the Microsoft ecosystem, but a routine test on an older version accidentally led us straight to a brand-new 0-day. In this write-up, we escalate a simple Stored XSS vulnerability into a full Remote Code Execution (RCE) chain (CVE-2026-40321). Read the full article to see how we smuggled payloads inside SVG files, weaponized DNN's internal messaging to spear-phish admins, and seamlessly dropped an ASPX backdoor right into the server root
Author(s)
Matei "Mal" Badanoiu (aka CVE Jesus)
Published at
20 Apr 2026
Updated at
21 Apr 2026
Security research
Throwing a spark into FuelCMS
FuelCMS v1.5.2 might be an older, largely unmaintained project, but its codebase is still highly combustible. In our latest research sprint, we uncovered seven new vulnerabilities lurking under the hood. Read the full article to see the raw HTTP requests, learn how we bypassed brute-force rate limits, and watch us turn simple template syntax into a full system compromise.
Author(s)
Matei "Mal" Badanoiu (aka CVE Jesus)
Published at
05 Mar 2026
Updated at
06 Mar 2026
Security research
cPanel - The valid, the suspect, and the 3rd party (Part 1)
Ever wondered what you can still do with 25-year-old code in a modern hosting environment? PTT-2025-021 was quite the journey! Unpack this (potentially Remote) Code Execution vulnerability we discovered and disclosed, which lets you bypass restricted environments like cPanel's jailshell. In part 1 of 3, we break down how an unsafe Perl "open" function became our ticket to a executing arbitrary system commands - and how the exploit works.
Author(s)
Matei "Mal" Badanoiu (aka CVE Jesus)
Published at
08 Jan 2026
Updated at
12 Jan 2026
Security research
How we built an exploit for SessionReaper, CVE-2025-54236 in Magento 2 & Adobe Commerce
Here's how we weaponized SessionReaper (CVE-2025-54236) against Magento 2, chaining ServiceInputProcessor quirks and a session proxy setter to forge customer sessions and hijack accounts. Our lab-tested PoC exposes attack surface, a possible preauth RCE, and an automated exploit - a practical walkthrough for researchers who like coffee strong and bugs reliable.
Author(s)
David Bors,
Matei "Mal" Badanoiu (aka CVE Jesus)
Published at
22 Oct 2025
Updated at
23 Mar 2026

Discover our ethical hacking toolkit and all the free tools you can use!

Create free account

Target illustration