CH

Valentin Lobstein

@Chocapikk

« Celui qui combat des monstres doit prendre garde de ne pas devenir monstre lui-même. »

France

Website

@Chocapikk_

Joined August 2021

952 Followers

165 Following

AI Insights & Achievements

63/ 100

Quality

Avg 28.7 stars per repo.

Growth

33 new projects with 1174 stars.

Veteran

Coding for 5 years.

Profile README

[!NOTE] Hi there! I'm Valentin Lobstein (aka Chocapikk), Security Engineer & Exploit Developer @ LeakIX.
Passionate about vulnerability research, exploit development, and internet-wide vulnerability detection.
Committed to sharing knowledge and building open-source tools

🚨 CVE Contributions

| CVE Identifier | Description | Links | |-------------------------------------------------------------------|------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------| | 🔒 CVE-2025-34433, CVE-2025-34441, CVE-2025-34442 | Unauthenticated RCE chain in AVideo via predictable salt bruteforce | Blog · VulnCheck | | 🔒 CVE-2025-34452 | Path Traversal + SSRF in Streama leading to arbitrary file write | Blog · VulnCheck | | 🔒 CVE-2025-34147 to CVE-2025-34152 | Multiple unauthenticated OS command injection vulnerabilities in the Shenzhen Aitemi M300 Wi-Fi Repeater (MT02). Affects: extap2g SSID, WISP-mode ssid, WPA2 key, PPPoE user, PPPoE passwd, time param in /protocol.csp?. Allows remote root code execution within Wi-Fi range. | Part 1 · Part 2 | | 🔒 CVE-2025-2611 | ICTBroadcast <= 7.4 – Unauthenticated RCE via cookie injection | GitHub | | 🔒 CVE-2025-2609 & CVE-2025-2610 | Stored XSS in MagnusBilling 7.x (one unauthenticated) | Blog · VulnCheck | | 🔒 CVE-2025-2292, CVE-2025-30004, CVE-2025-30005 & CVE-2025-30006 | Authenticated vulnerabilities in Xorcom CompletePBX ≤ 5.2.35 | File Disclosure · Command Injection · Path Traversal · Reflected XSS | | 🔒 CVE-2024-31819 | Unauthenticated RCE in WWBN AVideo via systemRootPath | GitHub | | 🔒 CVE-2024-30920 to CVE-2024-30929, CVE-2024-31818 | Research and exploitation in DerbyNet | GitHub | | 🔒 CVE-2024-22899 to CVE-2024-22903, CVE-2024-25228 | Exploit chain in Vinchin Backup & Recovery | GitHub | | 🔒 CVE-2024-3032 | Themify Builder < 7.5.8 – Open Redirect | WPScan | | 🔒 CVE-2023-50917 | Remote Code Execution in MajorDoMo | GitHub |

🧰 Skills & Languages

Skills & Languages

📚 Repositories

Tool	Description	Link
WPProbe	Fast WordPress plugin enumeration	GitHub
LFIHunt	Scan & exploit Local File Inclusion (LFI)	GitHub
LeakPy	Query LeakIX.net API via Python	GitHub

🏆 Hall Of Fame

🚨 Exploit Development & PoC

All PoCs and Metasploit modules consolidated in:
Chocapikk/msf-exploit-collection

☁️ LeakIX

Security Engineer
Notable finding: Massive PSaux ransomware attack affecting 22,000 CyberPanel instances (BleepingComputer)
Follow on Twitter: @leak_ix

🎶 Spotify

🎧 Warning: May contain questionable bangers and guilty pleasures.
🔓 All my work was done while vibing to tracker, synthwave, tribe / hardtek / frenchcore & video game music. It's here for a reason.

Spotify

[!CAUTION]
⚠️ Disclaimer
Please use the information and exploits provided in my repositories for educational purposes and responsible disclosure only. I am not responsible for any misuse or damage caused by using these tools, scripts, or exploits.

Public Repos

171

Total Stars

2867

Total Forks

542

Public Gists

2

Top Languages

Based on primary language of repositories

Recent Activity

Contribution Graph

Activity Timeline

Commits and contributions grouped by day, week, or month.

High productivity periods

Most active day: January 18th, 2026 • 92 contributions

Most active week: Jan 12–Jan 18 • 99 contributions

Most active month: Jan 2026 • 194 contributions

merged pull request in NixOS/nixpkgs

February 4th, 2026 10:52 PM

Pushed to fix-wpprobe-package at Chocapikk/nixpkgs

February 4th, 2026 5:54 PM

Pushed to fix-wpprobe-package at Chocapikk/nixpkgs

February 4th, 2026 5:44 PM

merged pull request in rapid7/metasploit-framework

February 4th, 2026 8:26 AM

Pushed to feat/add-endpoints-and-update-deps at Chocapikk/LeakIXClient-Python

February 3rd, 2026 11:32 AM

Pushed to feat/add-bulk-and-quick-recon at Chocapikk/leakix-mcp

February 3rd, 2026 11:05 AM

Pushed to feat/add-endpoints-and-update-deps at Chocapikk/LeakIXClient-Python

February 3rd, 2026 11:05 AM

Pushed to feat/add-bulk-and-quick-recon at Chocapikk/leakix-mcp

February 3rd, 2026 10:59 AM

Pushed to feat/add-endpoints-and-update-deps at Chocapikk/LeakIXClient-Python

February 3rd, 2026 10:58 AM

Pushed to feat/add-endpoints-and-update-deps at Chocapikk/LeakIXClient-Python

February 3rd, 2026 10:33 AM

GitHub Analytics

Valentin Lobstein

Quality

Growth

Veteran