Essity: Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████

An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message...

Essity: 29 Premium Plugin Packages with License Keys Publicly Accessible in Uploads Directory

A summary of the vulnerability found is as follows: 29 premium plugin packages with license keys were publicly accessible in the uploads directory of the WordPress media library. The packages were downloadable without authentication and contained the full plugin source code and embedded...

Essity: Reflected XSS in legacy CGI script /cgi-bin/████████.pl on ████████ via `████████` parameter

A legacy Perl CGI script on the target website was found to reflect user-supplied input from the ████████ parameter directly into the HTML response without output encoding. This allowed unauthenticated reflected cross-site scripting XSS via both GET and POST requests...

Essity: Error-Based SQL Injection in ████████.com Login/Password Reset (username parameter)

Note - We acknowledge that ████████.com may not be explicitly listed within the defined scope of your HackerOne program. However, I am submitting this in good faith given the critical severity of the finding. We want to clarify that: - No user data was extracted beyond confirming table existence...

Essity: Unauthenticated reflected XSS in Essity "Network Toolbox" CGI (████████ ████████

Summary Legacy Perl "Network Toolbox" CGI at ████████ reflects packetsize into the HTML response without output encoding. When packetsize is non-integer, the script echoes the raw value inside an error element, allowing arbitrary HTML/JS injection. No auth required; no CSP on the response. Steps ...

Essity: Reflected HTML Injection in ████████ Login Page via infotext/signintext Parameters

Summary: A reflected HTML injection vulnerability was identified on the ████████████████ login page. The page includes a custom JavaScript theme script that reads the URL parameters infotext and signintext and inserts them into the DOM using innerHTML. An attacker can craft a link to the ████████...

Essity: Critical SQL Injection WDM API (████████)

A boolean-based and time-based blind SQL injection vulnerability was discovered in the searchText query parameter of the GET /api/WDMProduct endpoint. The vulnerability allowed an unauthenticated attacker to read or modify data in the backing Microsoft SQL Server database. The backend was found t...

Essity: Unauthenticated File Upload with CORS Wildcard and No Rate Limiting on ████████ and ████████

An unauthenticated file upload vulnerability was discovered on two affected assets. The vulnerability allowed any website to silently upload malicious files, including PDFs with embedded JavaScript, to the backend storage. The vulnerability was exacerbated by the presence of a CORS wildcard and...

Essity: Unauthenticated Account Registration + Email Verification Bypass + PII Data Leak (2,480 Records) on ████████

A vulnerability was discovered in the portal of the organization. The vulnerability allowed any unauthenticated attacker to register an account, bypass email verification, and access protected API endpoints that leaked 2,480 employee records containing names, emails, and profile URLs. The...

Essity: Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)

A pre-authentication stored cross-site scripting XSS vulnerability was discovered in the customer service API of the Essity company. The API accepted unauthenticated ticket submissions with arbitrary HTML/JavaScript in multiple fields, bypassing reCAPTCHA validation, CSRF protection, and rate...

Essity: HTTP Request Smuggling

A vulnerability was discovered in the application that allowed HTTP Request Smuggling. This vulnerability stemmed from a discrepancy in how the front-end and back-end servers processed the Content-Length header, leading to a 0.CL desync. This made it possible for an attacker to control other user...

Essity: ████████ ████████ Server Full Exposure with Database Credentials

The web server was discovered to have directory listing enabled, exposing the entire file structure including database credentials, full website backups, and sensitive internal documents...