Real vulnerability disclosures from top bug bounty hunters. Filter by type and severity.
56 writeups
AcademyA business-management mobile API endpoint returned the internal CRM Contact ID associated with a supplied business-user identifier without verifying that the authenticated caller owned, or was authorized to access, that business-user object.
AcademyAn unauthenticated notification REST API exposed full CRUD operations over user dashboard notifications through POST, GET, and DELETE methods. Attackers could inject spoofed notifications into authenticated user dashboards, enumerate notifications by user identifier or sequential numeric ID, and delete arbitrary records without a session, token, API key, or ownership check.
AcademyAn invoice-export API accepted any non-empty token value and returned a public PDF URL for an arbitrary enumerable booking identifier. Because the API did not bind the caller to the requested booking, an unauthenticated attacker could enumerate booking IDs and retrieve customers’ invoice PDFs containing names, billing addresses, itineraries, and amounts paid.
AcademyA public developer AI chat REST endpoint stored conversation history under a client-visible conversation_id but did not verify that the supplied conversation_id belonged to the API key making the request. Any self-serve developer with an API key and a known or leaked conversation_id could retrieve another tenant’s AI chat history, including sensitive prompts and reference data.
AcademyCSRF in Organization Invitation Approval Flow Enables Unauthorized Onboarding of Pending Members
AcademyAn account-recovery API interpreted the supplied email selector as a wildcard pattern, allowing unauthenticated enumeration of arbitrary users. Although email addresses and phone numbers were visually masked, the API returned unsalted SHA-256 identifiers derived directly from the original values, making the masked PII recoverable. The report was accepted as High with CVSS 7.5 and rewarded with €400.
AcademyA server-side object authorization flaw in a payroll API allowed an attacker to keep their own identity fixed while changing only the employee identifier in the request path. This exposed other employees’ complete payment histories, including payment amounts, debt adjustments, payroll periods and internal observations.
AcademyAn unauthenticated boolean-based SQL injection was identified in a legacy Oracle-backed web application. A non-correlated scalar subquery was used to turn an Oracle error into a reliable boolean oracle, enabling character-by-character extraction of database metadata and any data accessible to the application account. The report was accepted as Critical with CVSS 10.0 and rewarded with €1,000.
AcademyA WebSSO path-normalization bypass (static-asset extension + %2e%2e) exposed a legacy connector's executor servlet, which concatenates a request parameter verbatim as a PL/SQL package name → unauthenticated arbitrary PL/SQL execution on production Oracle (error-based cross-schema read + reversible write proof).
AcademyA critical SQL injection vulnerability in an authentication endpoint allows attackers to execute arbitrary SQL commands, access sensitive data, and manipulate the database.
AcademyA reflected XSS vulnerability in the import map overrides feature allows attackers to execute arbitrary JavaScript in authenticated user contexts, risking account takeover and credential theft.
AcademyAn improper authentication flaw in the registration endpoint allows attackers to obtain a session token without credentials, enabling unauthorized access to sensitive personal information such as full name, birth date, and address.