cvargas.com

Offensive security · Remote, Colombia

Cristian
Vargas

Offensive Application Security Engineer
at Fluid Attacks

Finding vulnerabilities in software people depend on, like NestJS, Fastify, DOMPurify and Ghost.

Cristian Vargas depicted as a pixel-art vulnerability hunter
THE VULNERABILITY HUNTER

11 ENTRIES

CVEs & Advisories · Bestiary

Real software. Disclosed vulnerabilities. Research you can verify.

Featured discoveryHigh · 8.2

CVE-2026-2293

NestJS

Auth/authz bypass via path normalization (lack of data validation)

Auth bypass / netonRead advisory
Creatures cataloguedCVSS 4.0
Disclosed vulnerabilities, affected products, vulnerability classes and severity scores
ID / AdvisoryProductClassSeverity
CVE-2025-10655 FrappeHelpdesk 1.14.0 SQLi 8.6 High
CVE-2026-2293 NestJS11.1.13 (fixed 11.1.14) Auth bypass 8.2 High
CVE-2026-2880 @fastify/middie9.1.0 (fixed 9.2.0) Auth bypass 8.2 High
CVE-2025-11461 FrappeCRM 1.53.1 (fixed 1.54.0) SQLi 7.1 High
CVE-2025-10692 OpenSupports4.11.0 SQLi 7.1 High
CVE-2025-10696 OpenSupports4.11.0 IDOR 7.1 High
Reveal the full bestiary (11)
Additional disclosed vulnerabilities
ID / AdvisoryProductClassSeverity
CVE-2025-10695OpenSupports4.11.0SSRF6.9 Medium
CVE-2025-9960is-localhost-ip2.0.0SSRF6.9 Medium
CVE-2025-9862Ghost6.0.6 (5.99.0–5.130.3, 6.0.0–6.0.8; fixed 5.130.4/6.0.9)SSRF6.1 Medium
CVE-2026-0540co-foundDOMPurify3.1.3–3.3.1 (fixed 3.3.2)XSS5.3 Medium
CVE-2025-15056Quill2.0.3XSS5.1 Medium
Trophy Hall

Awards · Trophies

CTF and cyber competition results.

Featured achievement

1st · OAS Cyber Americas Cup

2026 · with Fluid Attacks

  • 1st · Kaspersky CTF — NA/SA/Caribbean

    2026 · qualified SAS CTF final, Bali · Fluid Attacks

  • 1st · Ekoparty CTF ×2

    2025–2026 · consecutive · Fluid Attacks

  • 1st · DragonJAR CTF

    2025

  • 2nd · DragonJAR CTF

    2026

  • Fluid Attacks CTF: Hall of Fame #1 · 1st Ed.1 · 2nd Ed.2

    LATAM Challenge · individual · cvargas

Writing · Grimoire

Research, secure code review and lessons from the field.

Featured Write-up · EN

HTTP Verb Tampering in NestJS: Bypassing Middleware with HEAD Requests

Read article

All writing →

03 TALKS

Talks · Chapel

Recorded sessions on AppSec, tooling and certifications.

Self-assessed

Skills · Attributes

Self-assessed, 1–10. Evidence alongside each attribute.

  • Web8/1011 CVEs · OSWE · CWEE · BSCP
  • Mobile8/10eMAPT
  • Research7/10Fluid Attacks advisories
  • AI9/10C-AI/MLPen · C-AgAIPen · Talk: Codex aplicado al AppSec
  • Cloud7/10CCSP-AWS
  • Binary Exploitation3/10
  • Crypto2/10
Relic Chamber

Certifications · Relics

Offensive web and AppSec certifications.

Inventory · 12 more

Contact · Save Room

A good place to
start a conversation.

For research, talks or disclosure coordination, reach out on LinkedIn.

Rest at the save point · LinkedIn