X (Formerly Twitter): CORS misconfig | Account Takeover

Summary: CORS misconfig is found on niche.co as Access-Control-Allow-Origin is dynamically fetched from client Origin header with credential true and different methods are enabled as well. Description: Basically, the application was only checking whether "//niche.co" was in the Origin header, tha...

Paragon Initiative Enterprises: Issue with password reset functionality [Minor]

Dear Team, There is password change issue with bridge.cspr.ng Issue: ------------- User is not receiving notification when he/she reset password via password reset link. when user change his info like password change. User doesn't get email notification for password change etc. It will be a good...

WordPress QAEngine Theme Privilege Escalation Vulnerability

qaengine vulnerability allows an attacker to have an administrator account on the target's website ------------------------------------------------------------------------------ WordPress QAEngine Theme Privilege Escalation...