Browse / Bykea

Bykea

See its reports on the map

What gets reported to Bykea

• Insecure Direct Object Reference5
• Business Logic3
• Information Disclosure2
• Access Control1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. IDOR on in-app hardcoded zombie endpoint Insecure Direct Object Reference (IDOR) · medium
   128 votes
2. Broken Access Control (IDOR) in Booking Detail and Bids Could Leads to Sensitive Information DisclosureInsecure Direct Object Reference (IDOR) · high
   108 votes
3. Critical Information Disclosure via /talos/api/v1/files/uploadInclusion of Sensitive Information in an Include File · critical
   97 votes
4. Improper Access Control Allows Trip Hijacking and Passenger/Driver PII DisclosureInsecure Direct Object Reference (IDOR) · medium
   80 votes
5. Ability to increase any customer offered fare (BAC)Insecure Direct Object Reference (IDOR) · medium
   76 votes
6. Exposed trip_no in WebSocket Responses Leading to Excessive information DisclosureImproper Access Control - Generic · medium
   64 votes
7. Bypassing Bronze Partner Wallet Restriction to Accept Trips with Negative BalanceBusiness Logic Errors · medium
   63 votes
8. Lack of Feedback Validation Permits Arbitrary Driver RatingsInsecure Direct Object Reference (IDOR) · medium
   60 votes
9. Lack of minimum value bid wheel verification on customer_bid in Rental TripsBusiness Logic Errors · low
   55 votes
10. Customer can cancel a individual booking in a batch, causing locking of partner.Business Logic Errors · medium
    49 votes
11. MongoDB Query Logs & Schema Leak via Unauthenticated EndpointLLM06: Sensitive Information Disclosure · low
    43 votes