LogicalBreach Academy

Writeups

Real vulnerability disclosures from top bug bounty hunters. Filter by type and severity.

Sort by

51 writeups

Insecure Direct Object Reference (IDOR) (CWE-639) PRO

Academy

Wildcard Account Lookup and Unsalted Hash Identifiers Defeat PII Masking

An account-recovery API interpreted the supplied email selector as a wildcard pattern, allowing unauthenticated enumeration of arbitrary users. Although email addresses and phone numbers were visually masked, the API returned unsalted SHA-256 identifiers derived directly from the original values, making the masked PII recoverable. The report was accepted as High with CVSS 7.5 and rewarded with €400.

pyus3r

Jul 21, 2026

CVSS7.5

€400

Insecure Direct Object Reference (IDOR) (CWE-639) PRO

Academy

Pre-Authentication Payroll History IDOR via a Client-Supplied Employee Identifier

A server-side object authorization flaw in a payroll API allowed an attacker to keep their own identity fixed while changing only the employee identifier in the request path. This exposed other employees’ complete payment histories, including payment amounts, debt adjustments, payroll periods and internal observations.

pyus3r

Jul 21, 2026

CVSS7.5

€400

SQL Injection (CWE-89) PRO

Academy

Unauthenticated Oracle Boolean-Based SQL Injection Through a Legacy Search Filter

An unauthenticated boolean-based SQL injection was identified in a legacy Oracle-backed web application. A non-correlated scalar subquery was used to turn an Oracle error into a reliable boolean oracle, enabling character-by-character extraction of database metadata and any data accessible to the application account. The report was accepted as Critical with CVSS 10.0 and rewarded with €1,000.

pyus3r

Jul 21, 2026

CVSS10

€1,000

SQL Injection (CWE-89) PRO

Academy

Unauthenticated PL/SQL Injection via a Package-Name Parameter (Oracle, error-based)

A WebSSO path-normalization bypass (static-asset extension + %2e%2e) exposed a legacy connector's executor servlet, which concatenates a request parameter verbatim as a PL/SQL package name → unauthenticated arbitrary PL/SQL execution on production Oracle (error-based cross-schema read + reversible write proof).

pyus3r

454

Jul 16, 2026

CVSS10

€1,000

SQL Injection (CWE-89) PRO

Academy

Unauthenticated Error-Based SQL Injection via an Identity Header (SiteMinder SM_USER)

A critical SQL injection vulnerability in an authentication endpoint allows attackers to execute arbitrary SQL commands, access sensitive data, and manipulate the database.

pyus3r

1,047

Jul 14, 2026

CVSS10

€1,000

Cross-site Scripting (XSS) - Reflected (CWE-79)FREE

Academy

[Duplicate] Reflected XSS in Import Map Overrides Enables Account Takeover

A reflected XSS vulnerability in the import map overrides feature allows attackers to execute arbitrary JavaScript in authenticated user contexts, risking account takeover and credential theft.

pyus3r

Jul 8, 2026

CVSS8.1

€0

Improper Authentication - Generic (CWE-287)FREE

Academy

[Duplicate] Unauthorized Access to PII via Improper Authentication in Registration Endpoint

An improper authentication flaw in the registration endpoint allows attackers to obtain a session token without credentials, enabling unauthorized access to sensitive personal information such as full name, birth date, and address.

pyus3r

Jul 8, 2026

CVSS7.5

€0

Cross-site Scripting (XSS) - DOM (CWE-79)FREE

Academy

[Duplicate] DOM XSS in Charting Service's URL Parameter Enables Phishing

A DOM-based XSS vulnerability in the widgetScriptUrl parameter of a charting service allows execution of arbitrary JavaScript, enabling phishing attacks to capture user credentials and potentially take over accounts.

pyus3r

Jul 8, 2026

CVSS6.1

€0

Cross-site Scripting (XSS) - Reflected (CWE-79)FREE

Academy

[Duplicate] Reflected XSS in Chart Widget via connectorUrl Parameter

A reflected XSS vulnerability in the chart widget's connectorUrl parameter allows attackers to execute arbitrary JavaScript, potentially leading to credential phishing attacks on users.

pyus3r

Jul 8, 2026

CVSS6.1

€0

SQL Injection (CWE-89) PRO

Academy

[CVE-2026-40762] Unauthenticated SQL Injection in WPGraphQL < 2.11.1

An unauthenticated time-based blind SQL injection was confirmed in a public WPGraphQL `node(id:)` resolver affected by CVE-2026-40762. The issue was triggered by passing a crafted base64 Relay global ID that decoded to a malicious `user:<value>` identifier and reached a MySQL query path.

pyus3r

245

Jul 8, 2026

CVSS9.1

€150

Improper Access Control - Generic (CWE-284) PRO

Academy

Improper Access Control via Public API Key leads to Mass PII Disclosure

An unauthenticated PII disclosure issue was found in a public web portal backed by a production API gateway. The frontend exposed a public gateway key, and a pre-auth user lookup endpoint trusted that key while returning full user records for a broad email search instead of a masked or boolean response. A single unauthenticated request could return approximately 1.6k user records, including names, email addresses, internal user IDs and mobile phone numbers. The issue was accepted as High severity with CVSS 7.5 and rewarded with €400.

pyus3r

261

Jul 6, 2026

CVSS7.5

€400

Improper Access Control - Generic (CWE-284) PRO

Academy

Improper Access Control via Client-Supplied Document Identifier Leads to PII Disclosure

An unauthenticated Improper Access Control vulnerability was identified in a public mobile onboarding API. A registration action accepted a client-controlled document identifier and returned the associated identity profile without requiring a valid session, authorization token, or onboarding token.

pyus3r

322

Jul 3, 2026

CVSS7.5

€658