Open Source Junior Developer
Github
Learned the basic stack for developing and shipped code to GitHub in a regular basis for collaboration in Open source projects.
- learned to code
- Contributed in open source community
Nahid.
Known online as Fumioryoto.
Cybersecurity Researcher / Developer
I investigate web applications, research vulnerabilities, and explore the systems and assumptions behind digital products.
Technology & Security
- Python
- C
- C++
- Java
- .NET
- JavaScript
- Go
- Rust
- PHP
- Linux
- Kali Linux
- Parrot OS
- Fedora
- Ubuntu
- Arch Linux
- PortSwigger
- Wireshark
- Ghidra
- Cheat Engine
- Hack The Box
- TryHackMe
- OWASP
- Docker
- AWS
- Azure
- Git
About
Cybersecurity researcher & developer.
I'm Nahid (Mohammad Nahidul Islam), known online as Fumioryoto. My interests center on web application security and penetration testing, alongside ethical hacking, Linux and networking, and Python automation. I work in cybersecurity, focused mainly on web application security, penetration testing, and reverse engineering. Most of what I do involves taking applications apart to understand how they actually work, then looking for the places where that logic breaks down. That includes VAPT across web, network, and cloud environments (AWS, Azure), reverse engineering with Ghidra, x64dbg, and Cheat Engine, and OSINT investigations when a project calls for it. I also write my own scripts and tools when the ones available don't do what I need.
Experience
Selected experience
Penetration Tester & Bug Bounty Hunter
at Hackerone, Bugcrowd and Fiverr.
Identify, exploit, and report vulnerabilities in web applications, APIs, and associated backend services.
- Perform manual deep-dive testing of web apps against OWASP Top 10 (XSS, SQLi, IDOR, SSRF, etc.).
- Actively hunt on HackerOne and Bugcrowd, submitting clear, reproducible Proof-of-Concept reports.
- Provide scoped web app security testing gigs on Fiverr with actionable remediation steps.
- Validate and triage web vulnerabilities to filter false positives.
Research focus
Areas of interest
- Web Application Security
- Penetration Testing
- Ethical Hacking
- Reverse Engineering
- Linux and Networking
- Automation & Documentation
Selected projects
Work in practice
WordPress Core <= 7.0.1 - wp2shell Unauthenticated RCE Chain (REST API Batch Route Confusion + SQLi)
WordPress Core is vulnerable to a pre-authentication remote code execution chain dubbed 'wp2shell', affecting versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The chain combines a REST API batch-route confusion vulnerability (CVE-2026-63030) with a SQL injection flaw in the `author__not_in` parameter of the WP_Query class (CVE-2026-60137). This makes it possible for unauthenticated attackers to reach restricted functionality via the `/wp-json/batch/v1` endpoint and achieve arbitrary code execution on default WordPress installations with no plugins required.
WordPress Quiz Maker SQL Injection Exploit (CVE-2025-10042)
This script exploits an SQL Injection vulnerability in WordPress Quiz Maker plugin (≤ 6.7.0.56) by injecting payloads via an HTTP header (default: X-Forwarded-For).
Advanced Vulnerability Scanner & Exploiter for Next.js App Router
NextRce is a high-performance, multithreaded security tool designed to detect and exploit CVE-2025-55182. It specifically targets the React Server Components (RSC) implementation within the Next.js App Router architecture. By manipulating the serialization process in Server Actions, NextRce injects a crafted payload to achieve Remote Code Execution (RCE) on vulnerable instances. It features a smart detection engine that automatically distinguishes between vulnerable App Router architectures and safe legacy Pages Routers, ensuring efficiency during mass scans.
React2Shell
Nuclei template for detecting React2Shell (CVE-2025-55182 and CVE-2025-66478) A command-line tool for detecting CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components.
Simple keylogger that persistently sends data to telegram bot
What Happens When Run The script checks if it's already installed in the hidden location If not, it copies itself to %APPDATA%/winlog.exe Sets the file as hidden and system file Adds itself to Windows startup registry Launches the new hidden instance Starts capturing keystrokes Sends logs to Telegram at specified intervals
Terrapin Attack Exploit
The Terrapin attack (CVE-2023-48795) is a vulnerability in the SSH protocol that allows attackers to downgrade the security of the connection by manipulating sequence numbers during the handshake process. This scanner helps administrators identify vulnerable SSH servers and take appropriate action.
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the `kubio_hybrid_theme_load_template` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files..
Contact
Start a conversation.
For conversations around cybersecurity research, technical writing, and security practice.
Get in touch