Hoang Phuc Vo (HrxKnight)

Hoang Phuc Vo (HrxKnight) is a security researcher credited with 7 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #574 of 3,515 contributors. The disclosure was published in 2025.

Their research concentrates on Missing Authorization, which accounts for 2 of their findings (29%). Other recurring categories include SQL Injection, Unrestricted Upload Of File With Dangerous Type. The average CVSS score across these disclosures is 7.1, peaking at 8.8. Severity breakdown: 0 critical and 4 high.

The most affected software includes Booking Calendar and Notification (1), Code Clone (1), Gallery by BestWebSoft (1), across 7 distinct plugins, themes and core versions in total.

2 of the 7 disclosed issues have a vendor fix, while 5 remain unpatched. The most severe finding, "SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload", scores 8.8 out of 10.

2025

Critical

High

Medium

Low

Global Rank

#574

of 3,515 researchers

Vulns

Critical0

High4

Medium3

Low0

Affected Assets

7plugins

Avg CVSS

7.1

Average score of vulnerabilities

Researcher Submissions

7 records


2025-03-28 18:36	SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload SoJ SoundSlides <= 1.2.2	`CVE-2025-2249`	8.8 High	Hoang Phuc Vo (HrxKnight)	No
2025-03-21 17:52	Code Clone <= 0.9 - Authenticated (Administrator+) SQL Injection via snippetId Parameter Code Clone <= 0.9	`CVE-2025-2478`	4.9 Medium	Hoang Phuc Vo (HrxKnight)	No
2025-03-07 17:30	SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload SMTP by BestWebSoft <= 1.1.9	`CVE-2024-13908`	7.2 High	Hoang Phuc Vo (HrxKnight)	Yes
2025-03-06 00:00	Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.3 - Authenticated (Administrator+) PHP Object Injection Gallery by BestWebSoft <= 4.7.3	`CVE-2024-13906`	7.2 High	Hoang Phuc Vo (HrxKnight)	Yes
2025-02-28 15:23	Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions Booking Calendar and Notification <= 4.0.3	`CVE-2024-13746`	6.5 Medium	Pham Van Tam	No
2025-02-19 21:08	Legoeso PDF Manager <= 1.2.2 - Authenticated (Author+) SQL Injection via checkedVals Parameter Legoeso PDF Manager <= 1.2.2	`CVE-2025-0866`	6.5 Medium	Pham Van Tam	No
2025-02-17 15:46	GetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover GetBookingsWP <= 1.1.27	`CVE-2024-13677`	8.8 High	Hoang Phuc Vo (HrxKnight)	No

Showing 1–7 of 7 reports