Write-ups

Check The Published Writeups

Reset
WDBTitleTagsProgramsAuthorsTypePublicationAdded
361Upgrade plan from Free to Paid via Response Manipulation Payment bypass HTTP response manipulation NA Ibrahim Radi (@ibraradi9) Bug Bounty2023-03-032023-06-13
360How Your NFTs Could Have Been Stolen in Just One Click postMessage GraphQL NA PermaSecure (@PermaSecure) Bug Bounty2023-03-032023-06-13
359CS-Cart PDF Plugin Unauthenticated Command Injection RCE OS command injection Security code review CS-Cart Ngo Wei Lin (@Creastery) Bug Bounty2023-03-032023-06-13
358Web Cache Poisoning - Capability to disable/deface the app.██████████.com (A tale of poisoning through the layers of caching) Web cache poisoning NA Ankit Singh (@AnkitCuriosity) Bug Bounty2023-03-032023-06-13
355Unauthorized Access To Admin Panel via Swagger Missing authentication Broken Access Control Coca-Cola Arman (@M7arm4n) Bug Bounty2023-03-042023-06-13
35330-Minute Heist: How I Bagged a $1500 Bounty in Just few Minutes! Broken Access Control Logic flaw NA Charlie : The Hacker Bug Bounty2023-03-042023-06-13
352JS file enumeration for bug bounty hunters Information disclosure IDOR NA Aadarsh Anand (@ScreamZoro) Bug Bounty2023-03-042023-06-13
350500$ Bounty in just 5 minutes through Recon!!!! AWS misconfiguration Cloud storage misconfiguration NA Himanshu Pdy (@himanshu_pdy) Bug Bounty2023-03-052023-06-13
347Exposing Users Table From a Leaky GraphQL Query GraphQL Authorization flaw Broken Access Control NA Inderjeet Singh - encodedguy (@3nc0d3dGuY) Bug Bounty2023-03-062023-06-13
345Authentication Bypass Vulnerability in Mura CMS and Masa CMS (CVE-2022-47003 and CVE-2022-47002) Authentication bypass Security code review ColdFusion Mura CMS Masa CMS Brian (@hoyahaxa) Bug Bounty2023-03-062023-06-13
343Manipulating Encrypted Traffic for Manual and Automation Client-side encryption bypass Bruteforce NA Sourav Kalal (@Ano_F_) Bug Bounty2023-03-062023-06-13
342Remote Stealth Brute-force of Oracle Database Passwords Bruteforce Information disclosure Authentication bypass Components with known vulnerabilities NA Viktor Markopoulos Bug Bounty2023-03-062023-06-13
341A Vulnerability in Implementations of SHA-3, SHAKE, EdDSA, and Other NIST-Approved Algorithms Cryptographic issues Buffer Overflow Python PHP PyPy SHA3 for Ruby Keccak Team Nicky Mouha Bug Bounty2023-03-062023-06-13
337WordPress BuddyForms Plugin — Unauthenticated Insecure Deserialization (CVE-2023–26326) Insecure deserialization Security code review RCE NA Joshua Martinelle (@J0_mart) Bug Bounty2023-03-072023-06-13
336[Account Takeover] Don’t Send a Message to anyone Before Reading This [External Audit] HTTP response manipulation Authentication bypass Account takeover NA Vipul Sahu Bug Bounty2023-03-072023-06-13
333The story of becoming a Super Admin Hardcoded credentials Account takeover Information disclosure NA Ömer Kepenek (@omer_kepenek) Bug Bounty2023-03-082023-06-13
332PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749 RCE OS command injection Security code review Netgear Zion Basque (@mahal0z) Bug Bounty2023-03-082023-06-13
331How I got Owned A Multi-Billion Dollar Retailer’s MySQL Databases Using Simple SQL Injection SQL injection NA nav1n (@nav1n0x) Bug Bounty2023-03-082023-06-13
329Self XSS To Stored Through IDOR/ IDOR Self-XSS Stored XSS NA Arben Shala (@arbennsh) Bug Bounty2023-03-082023-06-13
327EJS - Server Side Prototype Pollution gadgets to RCE Server-side prototype pollution RCE Security code review Node.js third-party modules (EJS) Mizu (@kevin_mizu) Bug Bounty2023-03-092023-06-13
326Leveraging ssh-keygen for Arbitrary Execution (and Privilege Escalation) Local Privilege Escalation IoT NA Sean Pesce (@SeanPesce) Bug Bounty2023-03-092023-06-13
324Clipchamp ( Microsoft Office Product) - Google IAP Authorization bypass allowed access to Internal Environment Leading to Zero Interaction Account takeover Authorization bypass JWT Account takeover Microsoft (ClipChamp) Vikas Anil Sharma (@vikzsharma) Bug Bounty2023-03-102023-06-13
323I Earned $3500 and 40 Points for A GraphQL Blind SQL Injection Vulnerability. SQL injection GraphQL NA nav1n (@nav1n0x) Bug Bounty2023-03-102023-06-13
322Rxss inside href attribute - Bypassing lots of weird checks to takeover accounts! Reflected XSS WAF bypass NA Ashutosh Dutta (@maniacmarvel_) Bug Bounty2023-03-102023-06-13
321Default Credentials on Sony- Swag Time Hardcoded credentials Information disclosure Sony Arman (@M7arm4n) Bug Bounty2023-03-102023-06-13