Mail.ru: Подмена фотографий автомобиля [city-mobil.ru/taxiserv/]

Possibility to change the photo at external-storage.city-mobil.ru by controlling the parameter photourl and id on city-mobil.ru/taxiserv/...

Mail.ru: [city-mobil.ru/taxiserv/] SQLi at /taxiserv/requests path at driver_company param

SQL Injections in city-mobil.ru/taxiserv due to unsafe usage of GET parameters...

Mail.ru: Disclosure of the account email by phone number on [corporate.city-mobil.ru]

It was possible to obtain e-mail of the user registered in corporate.city-mobil.ru by phone number...

Mail.ru: Возможность просмотра коментариев к чужим обращениям [corporate.city-mobil.ru]

IDOR vulnerability in corporate.city-mobil.ru interface allowed to access a feedback comments of a different users...

Mail.ru: [https://fleet.city-mobil.ru] Stored XSS into driver mailing

Stored XSS via content of the message to driver in operator's interface...