Security Researcher

Onurcan Genç

Offensive security researcher and AI red-teamer. I find vulnerabilities in web applications and language models, then publish the findings so defenders can act on them.

Read ResearchAbout Me

Selected Findings

NocoBase VM Sandbox Escape

CVSS 10.0

Full server compromise through the formula/scripting engine.

Mautic SSTI-to-RCE Chain

CVSS 9.9

Server-side template injection escalating to remote code execution.

Ghost CMS SSRF

Critical

Server-side request forgery in the Ghost publishing platform.

Moodle & Decap CMS

Multiple CVEs

XSS, IDOR, and prompt injection across LMS and headless CMS.

Latest Posts

View all →

Research Areas

Vulnerability Research

Web framework audits, CVE disclosure, root-cause analysis.

Explore →

AI Security

LLM guardrail evaluation, jailbreak methods, mechanistic interpretability.

Explore →

CTF Writeups

HackTheBox, TryHackMe, and competition walkthroughs.

Explore →

General

Certifications, career notes, and industry observations.

Explore →