Evil-M5Project
Wi-Fi exploration and audit tool for M5Stack and ESP32 hardware, built for ethical use: research, demonstrations and training.
research · open source · disclosure
The proof is public.
Part of my work is open.
It’s what lets me show what I can do without breaking my clients’ confidentiality.
repositories
Projects
RaspyJack
Compact network toolkit for Raspberry Pi with a small screen, designed for on-site audits and teaching, with its own community.
All my repositories are on GitHub, and I write on my technical blog. Need a test on your system? See the services.
3 published · 2 reserved
Reported vulnerabilities
Each entry links to the corresponding advisory. "Reserved" marks an assigned ID whose publication in the MITRE registry is pending. As a matter of principle, no detail is given here on a disclosure still in progress.
CVE-2026-53625GLPI (IT asset management and ITSM)Privilege escalation via the REST API (authtype manipulation): from a technician account to super-administrator20267.5HighCVE-2025-63292FreeWifi_secure (Free Mobile)Subscriber identifier (IMSI) leak over EAP-SIM, passive capture2025PublishedCVE-2024-42533StandVoice (vendor Convivance)SQL injection (authentication bypass)20249.8CriticalCVE-2026-39191StandVoice (vendor Convivance)SQL injection leading to remote code execution2026ReservedCVE-2026-39192StandVoice (vendor Convivance)Sensitive file exposure2026Reserved
publications & talks
Publications & talks
Technical write-ups and public appearances. Talks and CTFs: LeHack 2025 · 404CTF · BreizhCTF (details on the blog).
ethics
Responsible disclosure
When I find a vulnerability, I first report it to the vendor or manufacturer and give them a reasonable time to fix it before any publication. I never disclose details of an unfixed flaw.
A coordinated disclosure is under way with a manufacturer. As a matter of principle, I won’t say anything about it until it is closed.
The same logic applies in reverse: if you find a flaw on this site, see the responsible disclosure policy.
A shared research project?
A topic, a bug, a collaboration? Write to me.
Reply within a few business days, no commitment.