Browse / FetLife

FetLife

See its reports on the map

What gets reported to FetLife

• Information Disclosure6
• Cross-site Scripting2
• Denial of Service1
• Business Logic1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Google API key leaked to PublicInformation Disclosure · low
   228 votes
2. Stored XSS via `Create a Fetish` section.Cross-site Scripting (XSS) - Stored · medium
   98 votes
3. fetlife.com/signup_step_profile expose access_token of mapbox.comInformativeCleartext Transmission of Sensitive Information · medium
   87 votes
4. Stored XSS via Angular Expression injection via Subject while starting conversation with other users.Cross-site Scripting (XSS) - Stored · medium
   82 votes
5. Able to access private picture/video/writing when requesting for their JSON responseInformation Disclosure · medium
   73 votes
6. Able to see location coordinates in any event without permission to do soInformation Disclosure · low
   62 votes
7. Specific Payload makes a Users Posts unavailableUncontrolled Resource Consumption · medium
   $10049 votes
8. Able to see highest poll result without voting or view resultInformativeInformation Exposure Through Debug Information · low
   44 votes
9. Able to detect if a user is FetLife supporter although this user hides their support badge in fetlife.com/conversations/{id} JSON responseInformation Disclosure · medium
   34 votes
10. Race condition in endpoint POST fetlife.com/users/invitation, allow attacker to generate unlimited invitesBusiness Logic Errors · medium
    30 votes