Security log

2026

Bug Bounty Program

Bypass filter and allow external image to be loaded in a webmail without user aggreement

TBD - Bug Bounty Program

Email: encoded-words decoded inside addr-spec local-part allow sender impersonation

TBD - Library

Email: encoded-words decoded inside addr-spec local-part allow sender impersonation

Zammad - Agent impersonation

Sender-impersonation vulnerability in Zammad’s inbound email handler that lets an unauthenticated attacker post articles attributed to any Zammad agent.

CVE-2026-8142 - Vince CERT/CC

Inbound-mail handler, encoded-word equality bypass + auth-check override

TBD - SSO solution, password-reset link host poisoning

A victim’s password-reset email with a link pointing at an attacker-controlled domain, carrying a live single-use reset token.

CVE-2026-63347 - path traversal vulnerability in the suricata-update package

A malicious tar or zip rule archive can reference members containing ../ so that suricata-update writes attacker-controlled files outside the configured rules directory.

CVE-2026-49825 - stored XSS

This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user’s browser.

mikel/mail - Email address spoofing

A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded output to differ from what a human reviewer or downstream parser would expect, allowing an attacker to spoof the apparent sender/recipient address.

2025

CTM

Presence of old wordpress plugins on several subdomains

Schoelcher / CACEM

Presence of personal data on both a municipality and public inter-municipality cooperation establishment in Martinique.

2024

Cap Nord

Presence of personal data through an indirect join between “anonymised” datasets in an invitation to tender of more than 100 millions euros.

2023

AFNIC

Undeleted data that exposes personal and sensitive data in breach of their own GDPR contract.

International mobility platform

SQL injection that allows to extract a platform production database.

CTM

SQL injection that allows to extract (deprecated ?) database on a territorial collectivity sub-entity

Large Group in Martinique and beyond

Unprotected route in mobile app that allows to access customer receipts for a large retailer in Martinique.

Espace Sud

SQL injection that allows to extract production database + configuration file disclosure on a territorial collectivity subdomain

Large Group in Martinique and beyond.

SQL injection that allows to extract production database of a for a large retailer in Martinique.

Dom-Enic (Groupe Canal+).

SQL injection that allows to extract production database for a critical web-facing service (.mq and .gf registrar).

Web CTM

Identify a local file access on a voting application that can allow an attacker to read arbitrary file on server (like configuration files) and access voting personal details (name, email) through the use of a token

2022

Web lib

Identify data leak (personnal details + partial credit card details) on wrongly implemented (and badly secured) websites using the payzen lib.

Web CTM

Identify a debug plugin activated that can provide database credentials when exception is generated

App Carrefour Martinique

Identify an unsolved data leak that can allow a person to use the reward of another person

2021

Web CTM

Identify an SQL injection vulnerable service and multiple information exposure.

Web CTM

Identify an SQL injection vulnerable service.

Web Cesecem

Identify an accessible installation plugin page that could allow to insert external content on an institutional website.

Web TousAntiPass

Identify two leaks of personal data that allow to retrieve the user database through simple pagination (completely in the first case, partially in the second case).

Org CTM

Identify a deprecated (but still used) domain not renewed. PoC (traffic + email catchall) that domain acquisition could create confidentiality, privacy and security issues. Domain is being transfered back to CTM.

2020

Web, Orange

Identify the leak of personal data through dorking.

Web, SFR Caraibes

Identify the leak of personal data when, while being loggued, through a modified query to a webservice. Found a sha1 password sent on the account page. Confirmed and solved.

Web, Odyssi

Identify the leak of personal data when, unlogged, through a modified query to a webservice. Confirmed and solved.

Web/Internet gateway, SFR

Report 6 vulnerabilities (at least 1 already reported) on the SFR gateway. Reviewed, asked to test the next beta version.

2019

Web, espace sud

Report the installation of a variant of the malware crypper on their website. Confirmed and solved.

App, Carrefour Martinique

Identify that the fidelity customer QR Code is an ID. Report shows it is possible to generate an ID, use it at the point of sale and 1. uses the credit associated to that user to pay for groceries, 2. obtain personal data on that user. Confirmed and solved.