Latest research: We disclosed a stored-XSS vulnerability in Rank Math SEO (2M+ installs). Read the advisory
Expert-led penetration testing from the researchers behind 200+ published CVEs. Our experts run every engagement and verify every finding with working proof.
200+
CVEs published
10+
senior experts running and verifying every engagement
Millions
of websites affected by our disclosures
Researchers behind 200+ CVEs run every engagement and verify every finding themselves. No false positives, no scanner noise.
Every finding ships with a working exploit or proof-of-concept and a clear fix. No theoretical risk, no severity-score hand-waving.
Expert-verified findings and working exploits reach you as the work happens, not after weeks of waiting for a final report.
Senior-researcher quality without the boutique-consultancy invoice. Clear, scoped, no surprises.
From scope to working exploit. Run by our experts at every step.
We map your attack surface and agree on rules of engagement.
Our experts attack your systems the way a real adversary would, chaining real vulnerabilities into working attack paths.
Our researchers validate every finding and ship a working proof-of-concept. No noise, no theoretical risk.
Clear, prioritized remediation guidance delivered fast, then we verify the fixes.
Expert-led, exploit-focused testing of web apps, APIs, and infrastructure. Every finding is run and verified by senior researchers and delivered fast, with a working exploit and clear, cost-effective scoping.
Zero-day research and responsible disclosure on the platforms you depend on. 200+ CVEs and counting.
Objective-based, stealth engagements that emulate a real attacker's full kill chain.
Secure-design review, threat modeling, and on-call expertise for your team.
We build reliable proof-of-concept and working exploits to validate risk and support your remediation.
We don't just claim skill. It's in the public record: 200+ CVEs and counting.
| CVE | Platform | Type | Severity |
|---|---|---|---|
| CVE-2024-32511 | Simple Registration for WooCommerce | Unauthenticated Privilege Escalation | Critical 9.8 |
| CVE-2024-24842 | Knowledge Base for Documentation, FAQs with AI Assistance | Unauthenticated PHP Object Injection in is_article_recently_viewed | Critical 9.8 |
| CVE-2022-29317 | Simple Bus Ticket Booking System | Unauthenticated SQL Injection via username and password parameters | Critical 9.8 |
| CVE-2024-31237 | s2Member | Limited Privilege Escalation | Critical 9.1 |
| CVE-2025-32160 | EventON | Authenticated (Contributor+) Local File Inclusion | High 8.8 |
| CVE-2024-53824 | All Bootstrap Blocks | Authenticated (Contributor+) Local File Inclusion | High 8.8 |
Showing the 6 most severe of 249 published CVEs on record.
View our researchThree offensive-security researchers who built Starfish and still run every engagement. One standard: prove it.
Founder@p3tl0v3r
Founder. OSWE-certified web-application researcher and Synack Red Team member (ex-VNPT Cyber Immunity). Publishes weaponized analyses of critical enterprise vulnerabilities and reports plugin CVEs. He sets Starfish's offensive methodology and leads the expert review behind every engagement.
Co-Founder@ancorn_
Co-Founder. OSWE-certified security engineer and one of the most prolific WordPress-ecosystem researchers on record: 246 CVEs credited on Wordfence, including critical unauthenticated privilege-escalation and object-injection findings. Two-time Synack Red Team Hero and Apple Hall of Fame honoree.
Co-Founder@taidh
Co-Founder. Penetration tester at VNPT Cyber Immunity, red-team operator and CTF player specializing in enterprise-software vulnerability analysis, from MOVEit Transfer to Mitel MiCollab. CPTS-certified Synack Red Team member.
Book a scoping call. We'll tell you honestly where you stand, and quote you clearly.