Active · Hunting · 2026

Al Baradi Joy

Cybersecurity Researcher & Ethical Hacker

Independent security researcher dedicated to making the web safer through responsible disclosure. Recognized by world-class organizations including NASA, WHO, and the U.S. GSA for uncovering critical vulnerabilities before the wrong hands found them.

Al Baradi Joy
ABJ · RESEARCHER · 2025 ▮
Active on
01 //

Hall of Fame

WHO
World Health Organisation
NASA
Letter of Recognition
GSA
U.S. Gen. Services Admin
ABB
Hall of Fame
Ollyo
Hall of Fame
Arlo
Hall of Fame
Pornhub
Hall of Fame
02 //

Published Exploits

CVE-2025-2563
EDB-ID: 52137
2025-04-07 · webapps
WordPress User Registration & Membership ≤ 4.1.1 — Unauthenticated Privilege Escalation
Unauthenticated attackers can escalate to administrator role. Affects the User Registration & Membership plugin for WordPress via improper privilege management (CWE-269).
9.8
CVSS
CRITICAL
CVE-2025-24893
EDB-ID: 52136
2025-04-07 · webapps
XWiki Platform 15.10.10 — Remote Code Execution
Any guest user can execute arbitrary code remotely via the SolrSearch endpoint, leading to full server compromise. Patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1.
9.8
CVSS
CRITICAL
CVE-2025-31131
EDB-ID: 52135
2025-04-07 · webapps
YesWiki < 4.5.2 — Unauthenticated Path Traversal (LFI)
Unauthenticated path traversal via the 'squelette' parameter allows reading arbitrary files such as /etc/passwd. Affects YesWiki versions before 4.5.2.
8.6
CVSS
HIGH
CVE-2025-24813
EDB-ID: 52134
2025-04-07 · webapps
Apache Tomcat 11.0.3 — Remote Code Execution
Path Equivalence RCE via partial PUT deserialization. Attacker uploads a serialized Java gadget payload, then triggers it via GET with a crafted JSESSIONID cookie. Affects Tomcat < 11.0.3 / 10.1.35 / 9.0.98.
9.8
CVSS
CRITICAL
CVE-2024-8856
EDB-ID: 52131
2025-04-06 · webapps
WP Time Capsule (Backup & Staging) ≤ 1.21.16 — Unauthenticated Arbitrary File Upload to RCE
Unauthenticated attackers can upload arbitrary files via upload.php. Uploading a PHP file allows direct remote code execution from the plugin's bridge directory.
9.9
CVSS
CRITICAL
CVE-2024-1234
EDB-ID: 52126
2025-04-05 · webapps
Exclusive Addons for Elementor ≤ 2.6.9 — Authenticated Stored XSS
Contributor-level users can inject persistent JavaScript via the 's' parameter due to insufficient input sanitization and output escaping in the Elementor plugin.
6.5
CVSS
MEDIUM
03 //

Write-Ups

[ LOADING ARTICLES ]_
04 //

About

Al Baradi Joy is an independent cybersecurity researcher focused on uncovering vulnerabilities in widely-used software through ethical hacking and responsible disclosure.

With 6 published exploits on Exploit-DB — including multiple critical-severity CVEs against Apache Tomcat, XWiki, and WordPress plugins — and recognition from NASA, WHO, and the U.S. General Services Administration, Joy demonstrates that a solo researcher with curiosity and discipline can make a real difference in global security.

Publishing PoC exploits on GitHub (@a1baradi) and write-ups on Medium. "Just hunt if I get excited to hack something."

ssh — albaradijoy@researcher.io
05 //

Contact

bash — secure_channel.sh · 256-bit encrypted