http://blog.najdek.me/tags/security/Recent content in Security on Mateusz Najdek - blogHugo -- gohugo.ioen-usmateusz@najdek.me (Mateusz Najdek)mateusz@najdek.me (Mateusz Najdek)Sat, 30 May 2026 01:10:22 +0200http://blog.najdek.me/posts/responsible-disclosure-reflected-xss-sso/Sat, 30 May 2026 01:10:22 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/responsible-disclosure-reflected-xss-sso/Disclaimer: The vulnerability described below was discovered during independent security research. It has been responsibly disclosed to the institution’s IT department and was patched immediately. All sensitive details (target name, URLs) have been redacted to maintain confidentiality. Introduction Following up on my October 2025 discovery of a Path Traversal vulnerability in the Student Portal, I continued to keep an eye on the core infrastructure of the institution. Once you realize that legacy components exist in production, it is only logical to examine how the most critical gateways handle data.http://blog.najdek.me/posts/responsible-disclosure-path-traversal/Mon, 08 Dec 2025 01:16:36 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/responsible-disclosure-path-traversal/Disclaimer: The vulnerability described below was discovered during independent security research. It has been responsibly disclosed to the institution’s IT department and was patched immediately. All sensitive details (target name, URLs) have been redacted to maintain confidentiality. Introduction With a background in e-commerce engineering and system architecture, I have a habit of checking the “health” of the systems I interact with. During my first week of university, while browsing the Student Portal, my “security radar” went off.http://blog.najdek.me/posts/ps5-lua-autoloader/Mon, 30 Jun 2025 12:00:00 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/ps5-lua-autoloader/Context: In the console security scene, a “Jailbreak” is rarely a single file. It’s usually a complex chain of vulnerabilities. When the PS5 Lua exploit (based on the Artemis game engine) was released, it was a raw developer tool: it opened a network port and waited for a PC to send code. This is fine for researchers, but terrible for usability. I engineered a full “Plug-and-Play” automation layer: an Autoloader that removes the PC dependency, and a graphical User Interface powered by an embedded HTTP server.