HexBrain
Sign in

Browse / Bypasses / Same-origin and CORS rules

Getting past same-origin and cors rules

Origin allow-lists, CORS headers and same-origin policy gaps. 53 disclosed reports got past one.

  1. XSS in steam react chat clientCross-site Scripting (XSS) - Stored · critical · Valve
    $7,500499 votes
  2. Subdomain takeover of datacafe-cert.starbucks.comPrivilege Escalation · high · Starbucks
    311 votes
  3. Account takeover through the combination of cookie manipulation and XSSCross-site Scripting (XSS) - Stored · high · Superhuman (formerly Grammarly)
    292 votes
  4. SOP bypass using browser cacheImproper Access Control - Generic · Keybase
    185 votes
  5. Subdomain takeover of storybook.lystit.comPrivilege Escalation · high · Lyst
    $1,000163 votes
  6. Bypassing CORS Misconfiguration Leads to Sensitive ExposureBusiness Logic Errors · medium · U.S. Dept Of Defense
    145 votes
  7. DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolServer-Side Request Forgery (SSRF) · PortSwigger Web Security
    144 votes
  8. Subdomain takeover in Gitlab pagesMisconfiguration · low · GitLab
    79 votes
  9. CORS misconfiguration leads to users information disclosure at https://studyroom.line.meInformation Disclosure · medium · LY Corporation
    73 votes
  10. Subdomain takeover in GitLab Pages [george.ratelimited.me]Improper Restriction of Authentication Attempts · high · RATELIMITED
    59 votes
  11. Stored XSS at https://linkpop.comCross-site Scripting (XSS) - Stored · medium · Shopify
    53 votes
  12. Same Origin Policy Bypass at ██████.comImproper Access Control - Generic · ██████
    50 votes
  13. Moodle XSS on evolve.glovoapp.comCross-site Scripting (XSS) - Reflected · medium · Glovo
    41 votes
  14. Onion-Location header allows to open arbitrary URLs including chrome:Violation of Secure Design Principles · high · Brave Software
    40 votes
  15. S3 bucket takeover [learn2.khanacademy.org]high · Khan Academy
    35 votes
  16. Argo CD CSRF leads to Kubernetes cluster compromiseCross-Site Request Forgery (CSRF) · high · Internet Bug Bounty
    $4,66034 votes
  17. EC2 subdomain takeover at http://████████/Privilege Escalation · critical · U.S. Dept Of Defense
    33 votes
  18. Make API calls on behalf of another user (CSRF protection bypass)Cross-Site Request Forgery (CSRF) · Vimeo
    33 votes
  19. Possible SOP bypass in www.starbucks.com due to insecure crossdomain.xmlCross-Site Request Forgery (CSRF) · high · Starbucks
    29 votes
  20. CORS bypass on TikTok Ads EndpointMisconfiguration · medium · TikTok
    $25719 votes
  21. GraphQL introspection query works through unauthenticated WebSocketMisconfiguration · medium · Nuri
    17 votes
  22. Subdomain takeover [​████████]Privilege Escalation · critical · U.S. Dept Of Defense
    15 votes
  23. Bypass to postMessage origin validation via FTPCross-site Scripting (XSS) - Generic · high · Slack
    15 votes
  24. Same origin policy bypass on e.mail.ru via Cross-Site FlashingImproper Access Control - Generic · Mail.ru
    15 votes
  25. Bypassing SOP with XSS on account.my.games leading to steal CSRF token and user informationCross-Site Request Forgery (CSRF) · Mail.ru
    13 votes
  26. Brave News feeds can open arbitrary chrome: URLsPrivilege Escalation · high · Brave Software
    12 votes
  27. login csrf in analytics.mopub.comCross-Site Request Forgery (CSRF) · medium · X / xAI
    $28012 votes
  28. Navigation to restricted origins via "Open in new tab"Improper Access Control - Generic · medium · Brave Software
    12 votes
  29. CSRF possible when SOP Bypass/UXSS is availableViolation of Secure Design Principles · LocalTapiola
    $5012 votes
  30. CSRF possible when SOP Bypass/UXSS is available Cross-Site Request Forgery (CSRF) · HackerOne
    $2,50011 votes
  31. AWS subdomain takeover of www.███████Improper Access Control - Generic · high · U.S. Dept Of Defense
    10 votes
  32. XSSCross-site Scripting (XSS) - Generic · Reddit
    10 votes
  33. Unrestricted File Upload on https://my.stripo.email and https://stripo.emailUnrestricted Upload of File with Dangerous Type · medium · Stripo Inc
    9 votes
  34. [out-of-scope] toxiproxy: Lack of CSRF protection allows an attacker to gain access to internal Shopify networkServer-Side Request Forgery (SSRF) · medium · Shopify
    8 votes
  35. Responsible Disclosure of Privacy Leakage IssuePrivacy Violation · high · GitLab
    7 votes
  36. ███████mill is vulnerable to cross site request forgery that leads to full account take over.Cross-Site Request Forgery (CSRF) · high · U.S. Dept Of Defense
    7 votes
  37. XSS via Client Side Template Injection on www.███/News/SpeechesCross-site Scripting (XSS) - Generic · medium · U.S. Dept Of Defense
    6 votes
  38. Reflected XSS at https://█████ via "██████████" parameterCross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    6 votes
  39. Bypassing CORS Misconfiguration Leads to Sensitive Exposure at https://███/Violation of Secure Design Principles · medium · U.S. Dept Of Defense
    6 votes
  40. xssCross-site Scripting (XSS) - Generic · high · Stellar.org
    6 votes
  41. Same-Origin Policy bypass on main domain - ok.ruImproper Access Control - Generic · ok.ru
    5 votes
  42. Same Origin Policy bypassCross-Site Request Forgery (CSRF) · Mail.ru
    $6005 votes
  43. Misconfigured crossdomain.xml - vimeo.comCryptographic Issues - Generic · Vimeo
    5 votes
  44. Bypassing Same Origin Policy With JSONP APIs and FlashImproper Access Control - Generic · Internet Bug Bounty
    5 votes
  45. Reflected XSS at https://█████████ via "███" parameterCross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    4 votes
  46. misconfigured CORS let to HPP and SOP bypassMisconfiguration · high · BTFS
    4 votes
  47. Same-Origin Policy Bypass #2 Improper Access Control - Generic · ok.ru
    4 votes
  48. Reflected XSS at https://██████/██████ via "██████" parameterCross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    3 votes
  49. Reflected XSS at https://██████/██████████ via "████████" parameterCross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    3 votes
  50. Reflected XSS at https://██████████/████████ via "███████" parameterCross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    2 votes
  51. Reflected XSS on Zomato APICross-site Scripting (XSS) - Generic · Eternal
    2 votes
  52. Wrong Handling of Content-Type allows Flash injection and Rosseta flash patch bypassCross-site Scripting (XSS) - Generic · Internet Bug Bounty
    $3,0001 votes
  53. XSS via modified Zomato widget (res_search_widget.php)Cross-site Scripting (XSS) - Generic · Eternal