Browse / Bypasses / Content Security Policy

Getting past content security policy

Script and resource policies, nonces and allow-listed hosts. 79 disclosed reports got past one.

1. HEY.com email stored XSSCross-site Scripting (XSS) - Stored · critical · Basecamp
   $5,000360 votes
2. Stored XSS in markdown via the DesignReferenceFilter Cross-site Scripting (XSS) - Stored · critical · GitLab
   $16,000317 votes
3. Stored XSS via Kroki diagramCross-site Scripting (XSS) - Stored · high · GitLab
   $13,950295 votes
4. Cross-site Scripting (XSS) on HackerOne careers pageCross-site Scripting (XSS) - DOM · low · HackerOne
   $500239 votes
5. Reflected XSS on www.hackerone.com via Wistia embed codeCross-site Scripting (XSS) - Reflected · low · HackerOne
   $500236 votes
6. XSS via Direct Message deeplinksCross-site Scripting (XSS) - DOM · X / xAI
   236 votes
7. Stored-XSS with CSP-bypass via labels' colorCross-site Scripting (XSS) - Stored · high · GitLab
   169 votes
8. Stored XSS in Notes (with CSP bypass for gitlab.com)Cross-site Scripting (XSS) - Stored · high · GitLab
   161 votes
9. Possible XSS vulnerability without a content security bypassCross-site Scripting (XSS) - Generic · medium · Stripe
   $2,000131 votes
10. CSP bypass on PortSwigger.net using Google script resourcesCross-site Scripting (XSS) - Reflected · medium · PortSwigger Web Security
    113 votes
11. CSP-bypass XSS in project settings pageCross-site Scripting (XSS) - Generic · high · GitLab
    100 votes
12. [h1-415 2020] Spent a week and failed at solving the last step.Improper Access Control - Generic · critical · h1-ctf
    99 votes
13. Bypass: Stored-XSS with CSP-bypass via scoped labels' colorCross-site Scripting (XSS) - Stored · high · GitLab
    96 votes
14. Direct IP Access to Websitecritical · Lichess
    95 votes
15. Persistent DOM-based XSS in https://help.twitter.com via localStorageCross-site Scripting (XSS) - Stored · medium · X / xAI
    84 votes
16. Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"Cross-site Scripting (XSS) - Stored · high · GitLab
    80 votes
17. stored XSS in hey.com message contentCross-site Scripting (XSS) - Stored · medium · Basecamp
    80 votes
18. Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/new Cross-site Scripting (XSS) - Generic · medium · GitHub
    76 votes
19. Stored-XSS injected in Wiki page via Banzai pipelineCross-site Scripting (XSS) - Stored · high · GitLab
    71 votes
20. Possible DOM XSS on app.hey.comCross-site Scripting (XSS) - DOM · high · Basecamp
    68 votes
21. Query parameter reordering causes redirect page to render unsafe URLCross-site Scripting (XSS) - Reflected · medium · HackerOne
    $1,50061 votes
22. [h1-415 2020] Multiple vulnerabilities leading to leaking of secret user filesServer-Side Request Forgery (SSRF) · critical · h1-ctf
    56 votes
23. Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/ Cross-site Scripting (XSS) - Reflected · medium · PayPal
    54 votes
24. Email templates XSS by filterXSS bypassCross-site Scripting (XSS) - Generic · high · Judge.me
    $1,25051 votes
25. csp bypass + xssCross-site Scripting (XSS) - Generic · X / xAI
    51 votes
26. Stored XSS in markdown when redacting referencesCross-site Scripting (XSS) - Stored · high · GitLab
    $5,00050 votes
27. CSP Bypass and escalation of https://hackerone.com/reports/2279346Business Logic Errors · high · PortSwigger Web Security
    48 votes
28. XSS vulnerability without a content security bypass in a `CUSTOM` App through Button tagCross-site Scripting (XSS) - Generic · medium · Stripe
    $2,00046 votes
29. Content Security Policy not applied to error pages at multiple HackerOne endpointsViolation of Secure Design Principles · low · HackerOne
    45 votes
30. Google Analytics could be used as CSP bypass for data exfiltration on hackerone.comViolation of Secure Design Principles · low · HackerOne
    44 votes
31. Sub-Domain Takeover at http://www.codefi.consensys.net/Improper Access Control - Generic · medium · MetaMask
    $50042 votes
32. Stored XSS in Mermaid when viewing Markdown filesCross-site Scripting (XSS) - DOM · high · GitLab
    42 votes
33. Blind XSS - Report review - Admin panelCross-site Scripting (XSS) - Stored · medium · Eternal
    $35041 votes
34. Stored XSS on issue comments and other pages which contain notesCross-site Scripting (XSS) - Stored · high · GitLab
    $3,00038 votes
35. Bypassing Content-Security-Policy leads to open-redirect and iframe xssOpen Redirect · medium · Stripo Inc
    36 votes
36. Stored XSS in Dovetale by application of creatorCross-site Scripting (XSS) - Stored · medium · Shopify
    $1,60034 votes
37. Stored XSS in merge request creation page through payload in approval rule nameCross-site Scripting (XSS) - Stored · high · GitLab
    32 votes
38. CRLF and XSS stored on ton.twitter.comCross-site Scripting (XSS) - Generic · X / xAI
    $1,68032 votes
39. Reflected XSS on Partners SubdomainCross-site Scripting (XSS) - Reflected · high · Uber
    $2,00031 votes
40. [CVE-2024-54133] Possible Content Security Policy bypass in Action DispatchCross-site Scripting (XSS) - Generic · low · Internet Bug Bounty
    30 votes
41. Stored XSS in repository file viewerCross-site Scripting (XSS) - Stored · medium · GitLab
    $2,00029 votes
42. Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonceCross-site Scripting (XSS) - Generic · high · Basecamp
    27 votes
43. Stored DOM XSS via Mermaid chartCross-site Scripting (XSS) - Stored · high · GitLab
    $3,00027 votes
44. [tumblr.com] 69< Firefox Only XSS ReflectedCross-site Scripting (XSS) - Reflected · medium · Automattic
    25 votes
45. Domain Takeover - gl-canary.freetls.fastly.netPrivilege Escalation · low · GitLab
    $20025 votes
46. SafeParamsHelper::safe_params is not so safeCross-site Scripting (XSS) - Reflected · high · GitLab
    $4,00024 votes
47. HTTP/2 and HTTP/3 Header Injection in curlHTTP Response Splitting · curl
    20 votes
48. HTML Injection / Reflected Cross-Site Scripting with CSP on https://accounts.firefox.com/settingsImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium · Mozilla
    $1,00018 votes
49. [h1-415 2020] Multiple chained vulnerabilities lead to leaking secret documentInformation Disclosure · critical · h1-ctf
    18 votes
50. Reflected XSS when renaming a file with a vulnerable name which results in an errorCross-site Scripting (XSS) - Reflected · medium · Nextcloud
    $10017 votes
51. [h1-415 2020] h1ctf{y3s_1m_c0sm1c_n0w}Improper Access Control - Generic · critical · h1-ctf
    17 votes
52. [h1-415 2020] H1-415 CTF Writeup by W--Security Through Obscurity · critical · h1-ctf
    17 votes
53. Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color`Cross-site Scripting (XSS) - Reflected · medium · Nextcloud
    17 votes
54. Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp ReportsImproper Access Control - Generic · high · WordPress
    16 votes
55. Improper Input Validation on https://oberlo-image-proxy.shopifycloud.com/Shopify
    16 votes
56. [h1-415 2020] My writeup on how to retrieve the special secret documentImproper Authentication - Generic · critical · h1-ctf
    16 votes
57. DOM XSS vulnerability in search dialogue (NC-SA-2017-007)Cross-site Scripting (XSS) - Generic · low · Nextcloud
    $25016 votes
58. Content-Security Policy bypass with File UploadsImproper Access Control - Generic · high · Rocket.Chat
    14 votes
59. Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundleCross-site Scripting (XSS) - Reflected · medium · Nextcloud
    13 votes
60. Stored XSS in markdown file with Nextcloud Talk using Internet ExplorerCross-site Scripting (XSS) - Stored · low · Nextcloud
    13 votes
61. Bypass CSP frame-ancestors at olx.co.za, olx.com.ghUI Redressing (Clickjacking) · OLX
    13 votes
62. XSS in image metadata fieldCross-site Scripting (XSS) - Stored · medium · Nextcloud
    12 votes
63. [h1-415 2020] SSRF in a headless chrome with remote debugging leads to sensible information leakServer-Side Request Forgery (SSRF) · critical · h1-ctf
    12 votes
64. Reflected XSS on blockchain.infoCross-site Scripting (XSS) - Generic · medium · Blockchain
    12 votes
65. HTTP Digest nonce reused across an https→http scheme change on the same handleUncontrolled Resource Consumption · low · curl
    11 votes
66. [h1-415 2020] Chain of vulnerabilities leading to account takeover and unauthorized access of sensitive internal resourcesServer-Side Request Forgery (SSRF) · critical · h1-ctf
    11 votes
67. AWS subdomain takeover of www.███████Improper Access Control - Generic · high · U.S. Dept Of Defense
    10 votes
68. CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domainCross-Site Request Forgery (CSRF) · HackerOne
    $2,00010 votes
69. [h1-415 2020] @_bayotop h1-415-ctf writeupPrivilege Escalation · critical · h1-ctf
    7 votes
70. Stored XSS @ /engage/<project_slug>Cross-site Scripting (XSS) - Stored · medium · Weblate
    7 votes
71. [BugPOC and Amazon XSS CTF writeup] A CSP Bypass StoryCross-site Scripting (XSS) - DOM · BugPoC
    6 votes
72. HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0Cross-site Scripting (XSS) - Stored · low · Nextcloud
    6 votes
73. URI scheme bypass in mail app lead to HTML content spoof and opener controlViolation of Secure Design Principles · Nextcloud
    5 votes
74. CSP Policy Bypass and javascript executionImproper Access Control - Generic · Gratipay
    4 votes
75. csp bypass leads to xss on wacky.buggywebsite.comCross-site Scripting (XSS) - Generic · BugPoC
    $1003 votes
76. rails-ujs will send CSRF tokens to other originsCross-Site Request Forgery (CSRF) · Ruby on Rails
    3 votes
77. csrf_token cookie don't have the flag "HttpOnly"Cross-Site Request Forgery (CSRF) · Gratipay
    2 votes
78. Current CSP Policy chained with HTML Injection can lead to Data ExfiltrationViolation of Secure Design Principles · Liberapay
    1 votes
79. CSP Policy Bypass and javascript execution Still Not FixedImproper Access Control - Generic · Gratipay
    1 votes