1122 matches found
jbvideo.com XSS vulnerability
Vulnerable URL: http://jbvideo.com/signup?vopt=alert'OPENBUGBOUNTY';...
DCFM Blog 0.9.7 Blind SQL Injection Vulnerability
DCFM Blog version 0.9.7 suffers from a remote blind SQL injection vulnerability. DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Description ============ Open-source blog project. Free blo...
Yelp: CSRF on signup endpoint (auto-api.yelp.com)
Sign up request on https://auto-api.yelp.com/account/createsecure endpoint processes without any checking headers without cookies, csrf tokens and even user-agent. This is sample HTML form: --- Maybe when you will check it the signature will be expired, but it is not very difficult to generate th...
Brave Software: [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.html
go to https://brave.com/braveyouthprogramsignup.html click become an ambasador insert malicious payloads in the fields YOU JUST WON 1m$ you will receive a mail like in the image attached. You can send phising emails and do other bad stuff. If you need more details i'm here...
WebSummit: Subdomain take over signup.websummit
Subdomain take over Hi, You have a subdomain aka signup.websummit.net that point to a third party service hosted on Heroku: wsv1.herokuapp.com. The nslookup command shows the DNS configuration. $ nslookup signup.websummit.net 8.8.8.8 Server: 8.8.8.8 Address: 8.8.8.853 Non-authoritative answer:...
mechaero.ir XSS vulnerability
Vulnerable URL: http://mechaero.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4975205 VIP website status:| No Check mechaero.ir SSL connection:|...
ncsrm.shirazu.ac.ir XSS vulnerability
Vulnerable URL: http://ncsrm.shirazu.ac.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 18:51 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP websi...
ncca.ir XSS vulnerability
Vulnerable URL: http://ncca.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6418046 VIP website status:| No Check ncca.ir SSL connection:| Grade: A Coordinated Disclosure Timeline...
mdconf.ir XSS vulnerability
Vulnerable URL: http://mdconf.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3390821 VIP website status:| No Check mdconf.ir SSL connection:| Grade...
neconf.ir XSS vulnerability
Vulnerable URL: http://www.neconf.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 12527931 VIP website status:| No Check neconf.ir SSL connection:|...
webhr.co XSS vulnerability
Vulnerable URL: https://webhr.co/signup.php?package=Basica75iy"...
frontendmasters.com XSS vulnerability
Vulnerable URL: https://frontendmasters.com/signup/confirmed/?email=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FOPENBUGBOUNTY%2F%29%3E%22=%22%3E%3Cimg%20src=x%20onerror=prompt%28/OPENBUGBOUNTY/%29%3E%22 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability...
weibo.com XSS vulnerability
Open Bug Bounty ID: OBB-166991 Description| Value ---|--- Affected Website:| weibo.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...
ck12.org XSS vulnerability
Vulnerable URL: https://www.ck12.org/auth/signup/student?requestor='-alert'OPENBUGBOUNTY'-' Details: Description| Value ---|--- Patched:| Yes, at 21.03.2017 Latest check for patch:| 21.03.2017 22:47 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5833 VIP websit...
Keybase: Register multiple users using one invitation (race condition)
Hi, It is possible to create multiple accounts using a single invitationid due to a race condition bug in //api/1.0/signup.json. I have successfully created 8 accounts using invitation with id = 37c5a121adf23e90b875500d The account usernames: novijosiptest1,2,4,5,6,8,9,10 you can delete them, I...
gemselect.com XSS vulnerability
Vulnerable URL: https://www.gemselect.com/account/accsignup.php?sessid=" Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 10:09 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 50974 VIP website status:| No Chec...
XuezhuLi FileSharing Cross Site Request Forgery
document.forms.csrfpoc.submit; cat /srv/userlists.txt aaaa csrftest --...
Uber: Bulk UUID enumeration via invite codes
It is possible to enumerate UUID via invite code. During signup if we enter invite code then create request's response contains inviteruuid . As invite codes are public so attacker can easily enumerate bulk UUID . Here is sample request :- POST /signup/clients/create HTTP/1.1 X-Uber-RedirectCount...
wheniwork.com XSS vulnerability
Open Bug Bounty ID: OBB-157786 Description| Value ---|--- Affected Website:| wheniwork.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...