GeoServer SQL injection → RCE
Independently traced and reproduced a newly disclosed SQL injection-to-RCE chain in a controlled lab. Published a Python PoC and technical breakdown for CVE-2026-76904.
View GeoServer SQL injection → RCE on GitHub ↗Vulnerability Researcher & Penetration Tester
Mark Liudmirsky
02 / INVESTIGATE
Vulnerability Researcher / Penetration Tester
Research grounded in how systems actually behave: Android components and IPC, native binaries, authentication, and access control.
Android application security
Analyze exported components, Intents, IPC, and mutable PendingIntent behavior. Build Java PoC apps and reproduce behavior on emulators with ADB.
Reverse engineering & dynamic analysis
Static analysis with IDA Pro, runtime debugging with GDB and QEMU, and ARM/AArch64 work covering memory corruption, control-flow redirection, and ROP.
Original vulnerability research
Identified previously undisclosed vulnerabilities and reported them to maintainers. Technical details remain private while disclosure is pending.
Selected projects
TranslatePress administrator account takeover
Built a one-day PoC for CVE-2026-19632, demonstrating how disclosed password-reset links can lead to administrator account takeover in vulnerable TranslatePress installations.
View TranslatePress administrator account takeover on GitHub ↗Training
HDE — Offensive Attack & Intelligence Expert · SeeSecurity College · 2026. Graduated with distinction.
Bug bounty
Identified and reported access-control issues affecting notification settings and cross-account shopping-cart data through bug bounty programs.
CTF experience
- 2026 — boroCTF · sieberrSec CTF
- 2024 — Real World CTF — 6th place (team) · Mapna CTF
- 2023 — MapleCTF
- Earlier — BSidesTLV CTF · Hacktoberfest CTF