Hiro: Cross site request forgery

An e-mail signup form does not check CSRF tokens. This would allow the creation of click-able links which perform an e-mail signup. Because the e-mail signup form does not pass any sensitive information, nor perform any state changes on behalf of a user, this is not a vector for attack...

sezion.com XSS vulnerability

Vulnerable URL: https://sezion.com/signup?type=FREE%22%3E%3Cscript%3Ealert/OPENBUGBOUNTY/;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 10.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 868920 VIP website status:| N...

GSA Bounty: [api.data.gov] Leak Valid API With out Verification -

Description Remote attackers are able to retrieve a valid working api key with random Generation Process without a secure parsing or secure channel , human verification ..etc . the current proccess for requesting any api key is with signup form , and message with api delivered privately to user ,...

logz.io XSS vulnerability

Open Bug Bounty ID: OBB-264620 Description| Value ---|--- Affected Website:| logz.io Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

salesgossip.co.uk XSS vulnerability

Vulnerable URL: https://www.salesgossip.co.uk/signup?bl=/shop/next?sf=13031source=Googlemedium=CPCcampaign=Next=%20%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22=sgwebcpcgoogle=female=+\" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerabilit...

shopinas.com XSS vulnerability

Vulnerable URL: http://www.shopinas.com/signup/shopper Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 939934 VIP website status:| No Check shopinas.com SSL connection:| Grade: F...

hollywoodfotofix.com XSS vulnerability

Vulnerable URL: https://www.hollywoodfotofix.com/dealer/signup.php?action=add="--!"=0=====add1=add2=city=stateCode=otherState=code=countryCode=phone=fax=mobile=clientTypeID=9= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerabili...

Coinbase: Csrf bug on signup session

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, researchers are more likely to earn a larger bounty by explaining how a vulnerability can be exploited to cause harm to Coinbase or its users. Summary: CSRF bug on coinbase...

Starbucks: Host header injection/redirection via newsletter signup

Good evening, There's a host header injection vulnerability via all newsletter signups in the referrer attribute. This works with all pages that have "Join our email list" signup boxes. Since the referrer attribute can be changed to an outside domain the email being received redirects all links...

Unauthorised New User Signup

fatfreecrm is susceptible to unauthorised new user signup. The vulnerability exists because userscontroller does not prevent creation of a new user signup using crafted POST request...

WordPress Wow Viral Signups 2.1 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wow Viral Signups v2.1 WordPress Plugin SQL Injection Date: 29/03/2017 Exploit Author: TAD GROUP Vendor Homepage: http://wow-company.com/ Software Link: https://wordpress.org/plugins/mwp-viral-signup/ Version: 2.1 Contact:...

oooo.dating XSS vulnerability

Vulnerable URL: https://oooo.dating/app/signup.php Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 19:26 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3465154 VIP website status:| No Check oooo.dating SSL...

Multiple SQL Injection Vulnerabilities in WebsiteBaker

websitebaker is an open source content management system CMS. Websitebaker has multiple SQL injection vulnerabilities. Because account/signup.php does not properly handle the values of the variables "username" and "displayname", a remotely authenticated attacker registration is turned on by defau...

johndwood.co.uk XSS vulnerability

Vulnerable URL: http://www.johndwood.co.uk/content/myaccount/signup.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 634515 VIP website status:| No Check johndwood.co.uk SSL...

iFdate Social Dating Script 2.0 - SQL Injection

Exploit Title: iFdate Social Dating Script v2.0 - SQL Injection Google Dork: N/A Date: 18.03.2017 Vendor Homepage: http://turnkeycentral.com/ Software: http://turnkeycentral.com/scripts/social-dating-script/ Demo: http://demo.turnkeycentral.com/ifdate/index.php Version: 2.0 Tested on: Win7 x64,...

oilprice.com XSS vulnerability

Vulnerable URL: http://oilprice.com/market-intelligence/signup Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 19:05 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 23716 VIP website status:| Yes Check...

Pornhub: XSS Vulnerability at https://www.pornhubpremium.com/premium_signup? URL endpoint

The researcher discovered an XSS-vulnerable parameter at the premiumsignup endpoint...

signup.zebra.com XSS vulnerability

Vulnerable URL: https://signup.zebra.com/register.html?appId=%22%3E%3Csvg/onload=alert%27OPENBUGBOUNTY%27%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

DEBIAN-CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...