HexBrain
Sign in

Browse / Automattic

Automattic

166disclosed reports

See its reports on the map

What gets reported to Automattic

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Denial of service to WP-JSON API by cache poisoning the CORS allow origin headerUncontrolled Resource Consumption · medium
    405 votes
  2. Stored XSS in wordpress.comCross-site Scripting (XSS) - Stored · high
    356 votes
  3. IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignalInsecure Direct Object Reference (IDOR) · critical
    202 votes
  4. IDOR leads to Edit Anyone's Blogs / WebsitesInsecure Direct Object Reference (IDOR) · high
    177 votes
  5. Sql injection on docs.atavist.comSQL Injection · high
    170 votes
  6. SQL Injection Union BasedSQL Injection · critical
    137 votes
  7. [intensedebate.com] SQL Injection Time Based On /js/commentAction/SQL Injection · critical
    130 votes
  8. Email Verification bypass on signupViolation of Secure Design Principles · high
    127 votes
  9. Permanent DoS with one click.Uncontrolled Resource Consumption · medium
    127 votes
  10. Stored XSS vulnerability in comments on *.wordpress.comCross-site Scripting (XSS) - Stored · medium
    118 votes
  11. XSS in Email Input [intensedebate.com]Cross-site Scripting (XSS) - Generic · medium
    105 votes
  12. SQL Injection intensedebate.comSQL Injection · medium
    102 votes
  13. Woocommerce SQL Injection in WC_Report_Coupon_UsageSQL Injection · medium
    96 votes
  14. Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed MediaCross-site Scripting (XSS) - Stored · medium
    96 votes
  15. IDOR when moving contents at CrowdSignalInsecure Direct Object Reference (IDOR) · high
    94 votes
  16. Race condition on add 1 free domainBusiness Logic Errors · medium
    93 votes
  17. DOM XSS on multiple Automattic domains through postMessagesCross-site Scripting (XSS) - DOM · high
    92 votes
  18. DOM-Based XSS in tumblr.comCross-site Scripting (XSS) - DOM · medium
    91 votes
  19. Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerceDeserialization of Untrusted Data · high
    84 votes
  20. [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.phpSQL Injection · critical
    80 votes
  21. Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - BypassCross-site Scripting (XSS) - Stored · high
    78 votes
  22. XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code executionCross-site Scripting (XSS) - Generic
    76 votes
  23. Reflected XSS in https://www.intensedebate.com/js/getCommentLink.phpCross-site Scripting (XSS) - Reflected · medium
    75 votes
  24. Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE]Information Disclosure · high
    71 votes
  25. WordPress Flash XSS in *flashmediaelement.swf*Cross-site Scripting (XSS) - Generic
    70 votes
  26. Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://*your-subdomain*.survey.fmCross-site Scripting (XSS) - Stored · high
    68 votes
  27. Broken Authentication - Security token gets captured via man in the middle attackImproper Authentication - Generic · high
    67 votes
  28. Disclosure of 152 cookie names via crafted inputInformation Disclosure · low
    65 votes
  29. Captcha bypass for the most important function - At en.instagram-brand.comImproper Restriction of Authentication Attempts · medium
    65 votes
  30. No Email Checking at Invitation Confirmation Link leads to Account Takeover without User Interaction at CrowdSignalImproper Access Control - Generic · critical
    63 votes
  31. SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processingInformation Disclosure
    62 votes
  32. Stored XSS on wordpress.comCross-site Scripting (XSS) - Stored · medium
    60 votes
  33. Authentication & Registration Bypass in Newspack Extended AccessImproper Authentication - Generic · medium
    58 votes
  34. IDOR in API applications (able to see any API token, leads to account takeover)Insecure Direct Object Reference (IDOR) · critical
    58 votes
  35. XSS and HTML Injection on the pressable.com search boxCross-site Scripting (XSS) - Stored · medium
    57 votes
  36. DOM-Based XSS in tumblr.comCross-site Scripting (XSS) - DOM · medium
    56 votes
  37. [api.tumblr.com] Denial of Service by cookies manipulationUncontrolled Resource Consumption · medium
    55 votes
  38. Stored XSS in Intense Debate comment systemCross-site Scripting (XSS) - Stored · high
    52 votes
  39. Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboardInformation Disclosure · high
    52 votes
  40. Wordpress VIP leaks email of the test a/cInformation Disclosure · medium
    52 votes
  41. Open redirect via redirect_to parameter in tumblr.comOpen Redirect · low
    51 votes
  42. Authentication & Registration Bypass in Newspack Extended AccessImproper Authentication - Generic · medium
    51 votes
  43. [IDOR] Attacker user can Approve/Decline AFK on the behalf of other usersInsecure Direct Object Reference (IDOR)
    51 votes
  44. [intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabledBusiness Logic Errors · high
    50 votes
  45. IDOR when editing email leads to Account Takeover on AtavistInsecure Direct Object Reference (IDOR) · critical
    50 votes
  46. WordPress SOME bug in plupload.flash.swf leading to RCECode Injection
    50 votes
  47. Stored XSS in wordpress.comCross-site Scripting (XSS) - Stored · high
    48 votes
  48. Sensei LMS IDOR to send messageInsecure Direct Object Reference (IDOR) · low
    45 votes
  49. Unauthenticated Private Messages DIsclosure via wordpress Rest APIInformation Disclosure · medium
    45 votes
  50. reflected xss in https://wordpress.com/start/account/userCross-site Scripting (XSS) - Reflected · medium
    43 votes
  51. [intensedebate.com] XSS Reflected POST-Based Cross-site Scripting (XSS) - Reflected · low
    42 votes
  52. Authentication bypass on JetPack SSO manager - Allows to access the administration panel of wordpress without user interactionImproper Authentication - Generic · high
    41 votes
  53. Stored XSS in Jetpack's Simple Payment Module by Contributors / AuthorsCross-site Scripting (XSS) - Stored · medium
    41 votes
  54. Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.comImproper Authentication - Generic · high
    41 votes
  55. WooCommerce: Persistent XSS via customer address (state/county)Cross-site Scripting (XSS) - Stored · high
    40 votes
  56. cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com ) Violation of Secure Design Principles · medium
    39 votes
  57. Timeline API returns private post when target of a push notificationImproper Access Control - Generic · low
    38 votes
  58. DOM based XSS in the WooCommerce pluginCross-site Scripting (XSS) - DOM · medium
    37 votes
  59. Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You HeaderCross-site Scripting (XSS) - Stored · medium
    34 votes
  60. SSRF & Blind XSS in Gravatar email Cross-site Scripting (XSS) - Stored · high
    34 votes
  61. No Rate Limit when accessing "Password protection" enabled surveys leads to bypassing passwords via "pd-pass_surveyid" cookieBusiness Logic Errors · low
    33 votes
  62. Stored XSS on wordpress.comCross-site Scripting (XSS) - Stored · medium
    32 votes
  63. [api.tumblr.com] Exploiting clickjacking vulnerability to trigger self DOM-based XSSUI Redressing (Clickjacking) · low
    32 votes
  64. Site-wide CSRF at Atavist Cross-Site Request Forgery (CSRF) · high
    32 votes
  65. Unauthenticated RCE in VaultpressCode Injection · critical
    31 votes
  66. [FG-VD-19-022] Wordpress WooCommerce Cross-Site Scripting Vulnerability NotificationCross-site Scripting (XSS) - Stored · medium
    30 votes
  67. information disclosure lead to disclose users private notesInformation Disclosure · low
    29 votes
  68. Can buy Atavist Magazine subscription for freeImproper Access Control - Generic · high
    29 votes
  69. WooCommerce Blacklist in 'map_meta_cap' leads to Privilege Escalation of ShopmanagersPrivilege Escalation · high
    28 votes
  70. RCE via Print function [Simplenote 1.1.3 - Desktop app] Code Injection · high
    28 votes
  71. Insufficient DKIM record with RSA 512-bit key used on WordPress.comInadequate Encryption Strength · medium
    27 votes
  72. Captcha checker "pd-captcha_form_SURVEYID" cookie is accepting any valueImproper Access Control - Generic · medium
    26 votes
  73. [intensedebate.com] XSS Reflected POST-Based on update/tumblr2/{$id}Cross-site Scripting (XSS) - Reflected · medium
    25 votes
  74. [tumblr.com] 69< Firefox Only XSS ReflectedCross-site Scripting (XSS) - Reflected · medium
    25 votes
  75. WordPress core stored XSS via attachment file nameCross-site Scripting (XSS) - Generic
    25 votes
  76. Gaining unlimited bonus points on websites with WooCommerce Points and RewardsBusiness Logic Errors · high
    23 votes
  77. IDOR at 'media_code' when addings media to questionsInsecure Direct Object Reference (IDOR) · medium
    22 votes
  78. Rate Limit Misconfiguration on tumblr login .Improper Authentication - Generic
    21 votes
  79. No rate limit on app.crowdsignal.com (Finish quiz)Business Logic Errors · low
    21 votes
  80. Stored XSS in learnboost.com via the lesson[goals] parameter.Cross-site Scripting (XSS) - Stored
    21 votes
  81. xss filter bypass [polldaddy]Cross-site Scripting (XSS) - Generic
    21 votes
  82. [tumblr.com] CSRF in /svc/user/filtered_contentCross-Site Request Forgery (CSRF) · low
    20 votes
  83. Reflected XSS on a Atavist themeCross-site Scripting (XSS) - Reflected · medium
    20 votes
  84. [Simplenote for Windows] Client RCE via External JavaScript Inclusion leveraging ElectronCode Injection · high
    19 votes
  85. Improper markup sanitization.UI Redressing (Clickjacking)
    19 votes
  86. Cross Domain leakage of sensitive information - Leading to Account Takeover at Instagram BrandImproper Authentication - Generic · low
    19 votes
  87. Akismet API keys are exposed by authentication methodStoring Passwords in a Recoverable Format · low
    17 votes
  88. [intensedebate.com] Open RedirectOpen Redirect
    17 votes
  89. Denial-of- service By Cache Poisoning The Cross-Origin Resource Sharing Misconfiguration Allow Origin HeaderUncontrolled Resource Consumption · medium
    17 votes
  90. Stored XSS in www.learnboost.com via ZIP codes.Cross-site Scripting (XSS) - Stored
    17 votes
  91. No Rate Limit on CrowdSignal Polls when Adding CommentBusiness Logic Errors · low
    16 votes
  92. Improper markup sanitisation in Simplenote Android application.UI Redressing (Clickjacking)
    16 votes
  93. [app.simplenote.com] Stored XSS via Markdown SVG filter bypassCross-site Scripting (XSS) - Stored · medium
    16 votes
  94. https://secure.gravatar.commedium
    16 votes
  95. WooCommerce: Support Ticket indirect object referenceCross-Site Request Forgery (CSRF)
    16 votes
  96. Entering passwords on the Share Login Page can lead to a brute-force attackImproper Restriction of Authentication Attempts · low
    15 votes
  97. Ability to subscribe to inactive Post+ creatorsBusiness Logic Errors · low
    15 votes
  98. Reflected XSS at /category/ on a Atavis theme Cross-site Scripting (XSS) - Reflected · medium
    15 votes
  99. Arbitrary File Download as ShopmanagerPath Traversal · high
    15 votes
  100. Multiple File Manipulation bugs in WP Super Cache
    15 votes