Findings

[CRITICAL] · domain Self-hosted / private program · language Web application · task_alt Resolved

From Reflected XSS to Critical Bug Led to Sensitive Data Leakage

nyx0r · 1 week ago · favorite 3

View

P2 · Bugcrowd · language ████████ · task_alt Resolved

Stored Cross-Site Scripting (XSS)

0xbatot · 3 weeks ago · favorite 1

View

[LOW] · HackerOne · language ████████ · thumb_up Accepted content_copy Duplicate

Unverified Email Registration and Google OAuth Account Collision Lead Pre ATO

0xnotnull · 4 weeks ago · favorite 1

View

[MEDIUM] · HackerOne · language ████████ · outgoing_mail Submitted

Unverified account can reserve another user's email address lead to Pre ATO

0xnotnull · 4 weeks ago · favorite 1

View

[CRITICAL] · person_search Independent Research · language Web application · task_alt Resolved

Privilege Escalation Vulnerability Led me to be Application admin

nyx0r · 1 month ago · favorite 4

View

[HIGH] · HackerOne · api Internal API · task_alt Resolved content_copy Duplicate

Unauthenticated IDOR allows enumeration of employee information

elkashawi · 1 month ago · favorite 2

View

[HIGH] · domain Self-hosted / private program · language Web application · thumb_up Accepted

Stored XSS ----- organization control Via an automatic invitation to the organization

ghaziroot · 1 month ago

View

[LOW] · Intigriti · language Web application · task_alt Resolved content_copy Duplicate

BFLA ---- on GraphQL getMe query allows unauthorize access to low privileged user

ghaziroot · 1 month ago

View

[LOW] · Intigriti · language Web application · task_alt Resolved content_copy Duplicate

BFLA ---- on GraphQL ListAvailableRoles query allows unauthorize access to low privileged user

ghaziroot · 1 month ago

View

[HIGH] · person_search Independent Research · language Web application · outgoing_mail Submitted

Unauthenticated SSRF in `/target/api/request` allows any anonymous user to bypass documentation authentication and read protected/private docs sites cross-tenant

null_x07 · 1 month ago · favorite 4

View

[HIGH] · HackerOne · language ████████ · task_alt Resolved

I Found 5 Real Vulnerabilities Using Just GitHub's Search Bar

0xbatot · 1 month ago · favorite 4

View

[MEDIUM] · public Other · language ████████ · task_alt Resolved

Business Logic Erorr How I Silently Broke Every Note in a Project Management Platform

0xbatot · 1 month ago · favorite 1

View

[MEDIUM] · HackerOne · language Web application · cancel Unresolved content_copy Duplicate

Email Verification Bypass via Replay of `UPDATE_USER_INFO` Request

pebo_1 · 1 month ago · favorite 1

View

[LOW] · HackerOne · language Web application · cancel Unresolved content_copy Duplicate

OTP Verification Bypass in Phone Number Change

pebo_1 · 1 month ago · favorite 1

View

[HIGH] · public Other · language Web application · task_alt Resolved

Reflected XSS — Arbitrary JavaScript Execution and Session Cookie Exposure

pebo_1 · 1 month ago · favorite 1

View