melv.in
Melvin Lammerts
I build things that watch the internet and write about what they find.
Latest ·‘ OR 1=1 Still Works in 2026: Pre-Auth SQLi in Moodle (CVE-2026-7274)
On February 13, 2026, I reported a pre-authentication SQL injection in Moodle’s auth_db plugin to the Moodle bug bounty program on Bugcrowd. It was the kind of…
Read this post →Projects
asnproject
Looks up the subnets announced by an Autonomous System Number, straight from the command line.
crt.nameproject
A passive subdomain index over the Certificate Transparency firehose, with years of history backfilled in.
pathfinderproject
Pulls paths out of exposed status pages — Apache, PHP-FPM, Prometheus — for recon.
subfasterproject
A speed-tuned fork of Subfinder: keyless passive sources, silent by default, subdomains in seconds.