Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

salesgossip.co.uk XSS vulnerability

Vulnerable URL: https://www.salesgossip.co.uk/signup?bl=/shop/next?sf=13031source=Googlemedium=CPCcampaign=Next=%20%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22=sgwebcpcgoogle=female=+\" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerabilit...

shopinas.com XSS vulnerability

Vulnerable URL: http://www.shopinas.com/signup/shopper Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 939934 VIP website status:| No Check shopinas.com SSL connection:| Grade: F...

hollywoodfotofix.com XSS vulnerability

Vulnerable URL: https://www.hollywoodfotofix.com/dealer/signup.php?action=add="--!"=0=====add1=add2=city=stateCode=otherState=code=countryCode=phone=fax=mobile=clientTypeID=9= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerabili...

Coinbase: Csrf bug on signup session

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, researchers are more likely to earn a larger bounty by explaining how a vulnerability can be exploited to cause harm to Coinbase or its users. Summary: CSRF bug on coinbase...

Starbucks: Host header injection/redirection via newsletter signup

Good evening, There's a host header injection vulnerability via all newsletter signups in the referrer attribute. This works with all pages that have "Join our email list" signup boxes. Since the referrer attribute can be changed to an outside domain the email being received redirects all links...

Unauthorised New User Signup

fatfreecrm is susceptible to unauthorised new user signup. The vulnerability exists because userscontroller does not prevent creation of a new user signup using crafted POST request...

WordPress Wow Viral Signups 2.1 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wow Viral Signups v2.1 WordPress Plugin SQL Injection Date: 29/03/2017 Exploit Author: TAD GROUP Vendor Homepage: http://wow-company.com/ Software Link: https://wordpress.org/plugins/mwp-viral-signup/ Version: 2.1 Contact:...

oooo.dating XSS vulnerability

Vulnerable URL: https://oooo.dating/app/signup.php Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 19:26 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3465154 VIP website status:| No Check oooo.dating SSL...

Multiple SQL Injection Vulnerabilities in WebsiteBaker

websitebaker is an open source content management system CMS. Websitebaker has multiple SQL injection vulnerabilities. Because account/signup.php does not properly handle the values of the variables "username" and "displayname", a remotely authenticated attacker registration is turned on by defau...

johndwood.co.uk XSS vulnerability

Vulnerable URL: http://www.johndwood.co.uk/content/myaccount/signup.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 634515 VIP website status:| No Check johndwood.co.uk SSL...

iFdate Social Dating Script 2.0 - SQL Injection

Exploit Title: iFdate Social Dating Script v2.0 - SQL Injection Google Dork: N/A Date: 18.03.2017 Vendor Homepage: http://turnkeycentral.com/ Software: http://turnkeycentral.com/scripts/social-dating-script/ Demo: http://demo.turnkeycentral.com/ifdate/index.php Version: 2.0 Tested on: Win7 x64,...

oilprice.com XSS vulnerability

Vulnerable URL: http://oilprice.com/market-intelligence/signup Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 19:05 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 23716 VIP website status:| Yes Check...

Pornhub: XSS Vulnerability at https://www.pornhubpremium.com/premium_signup? URL endpoint

The researcher discovered an XSS-vulnerable parameter at the premiumsignup endpoint...

signup.zebra.com XSS vulnerability

Vulnerable URL: https://signup.zebra.com/register.html?appId=%22%3E%3Csvg/onload=alert%27OPENBUGBOUNTY%27%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

DEBIAN-CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

UBUNTU-CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

secure.docusign.com XSS vulnerability

Vulnerable URL: https://secure.docusign.com/signup/free?tgr=com-freeplan-netlogincouponcode=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VI...

New Relic: Moniter Failed Sends too many emails

Hello, While i was testing your program i found one vulnerabilty in your program, Steps To Reproduce 1. Go here https://newrelic.com/, and click on signup button. 2.Then put Javascript alert in Name field You can try any name too 3. Then put javascript:alertdocument.domain in You company field Yo...