Envoy: Abuse of API can Lead to DoS

Issue Description The researcher identified that it is possible to abuse the manual creation of employees via the api, meaning that a malicious attacker can create a trial account and use this to mass spam users' with emails, the screenshot below shows the mass amount of emails that can be sent i...

Royal Envoy - Base64 encoded String, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application Royal Envoy published at the 'play' market has multiple vulnerabilities...

Envoy: Stored XSS

Hello Security Team, I Have Found A Stored XSS Vulnerability in iPad Settings Page .. So .. Here Is How To Reproduce The Vulnerability: 1. Login To Your Account In Envoy 2. Change Your Company Name From Settings Page .. And Set It To Your Payload Like . Or You Can Create A New Account With This...

Envoy: [dashboard.signwithenvoy.com] Open Redirect

Open redirect via Request-URI PoC: https://dashboard.signwithenvoy.com//www.google.com/%2e%2e%2f HTTP Response: HTTP/1.1 303 See Other ... Location: //www.google.com/%2e%2e%2f/...

Envoy: Delete visitor from IPAD with fullname which contains JS results XSS

Hi, Update visitor from IPAD with fullname of alert1 and save. IGNORE THE POP UP, IT HAS BEEN REPORTED ALREADY Delete this user, XSS will pop up, the fullname is now stored XSS. Any visitor which using the IPAD application can create stored XSS which will be activate once you clicked on the delet...

Envoy: Stored XSS on adding locations

Authenticate into the application. 2. Navigate to https://signwithenvoy.com/locations 3. Click on "Add a new location" 4. Enter ";alert1" for Location Name. 5. Enter some random Location Admin's name, Location admin's email and password. 6. Click on "Add Location" 7. Notice that a pop-up appears...