Soufiane E.

Visit: selmelc.com for more information

I'm a software and cybersecurity enthusiast ! I write software for all types of applications and also provide vulnerability research to help companies secure their software. I have worked with the following companies and software developers to help secure their software : MongoDB, Monero, Curl, Fireblocks, Amazon, Hackerone. Among other which prefer to not be named.

When it comes to development I have a particular interest for low-level programming (C and Assembly based projects) either for userland or kernel space software. But I'm very flexible and can adapt technologies or languages.

I'm also a builder and enjoy creating innovating modern solutions through SaaS products mainly developed with FastAPI + SQLModel and React.

CTF player with a focus on reverse engineering and exploitation. Multi-finalist in national competition and active on most of the well known CTF platforms.

Published research (updated list on selmelc.com)

▪ CVE-2025-4373 : Integer overflow in glib leading to buffer under-write.

▪ CVE-2025-0755 : High impact buffer overflow in libbson affecting MongoDB Server.

▪ CVE-2024-6381 : Integer overflow to buffer overflow in MongoDB’s libbson.

▪ CVE-2024-6383 : Heap buffer overflow in MongoDB’s libbson.

▪ CVE-2023-0437 : Integer overflow leading to infinite loop of the MongoDB’s C driver.

▪ CVE-2023-38039: HTTP header allocation DoS in Curl.

▪ CVE-2023-32001: TOCTOU race condition in Curl.

▪ Monero Wallet RPC vulnerability : Discovered a credential leaking vulnerability in Monero’s official wallet software.

▪ Reported and patched multiple none publicly disclosed vulnerability for various clients

▪ Reported multiple vulnerabilities in the website of an educational Belgian company to the

Belgian CERT (CCB), for a preauthentification account takeover + IDOR leading to a

complete break of all the clients confidentiality + a bypass on the content’s paywalls.