Browse / Inflection

Inflection

See its reports on the map

What gets reported to Inflection

• Open Redirect5
• Access Control3
• Cross-site Scripting3
• Business Logic3
• Injection and Smuggling3
• Misconfiguration2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Identity Login Page Redirect Can Be ManipulatedOpen Redirect · high
   72 votes
2. Privilege Escalation: Read-Only to AdminPrivilege Escalation · high
   51 votes
3. Open redirect at app.goodhire.com via ReturnUrl parameterOpen Redirect · high
   23 votes
4. Open Redirect through POST RequestOpen Redirect · medium
   20 votes
5. Open RedirectOpen Redirect · medium
   18 votes
6. Privilege Escalation.Privilege Escalation · low
   16 votes
7. XSS at https://app.goodhire.com/member/GH.aspxCross-site Scripting (XSS) - Generic · medium
   14 votes
8. Clickjacking on https://www.goodhire.com/apiUI Redressing (Clickjacking) · low
   12 votes
9. Session ID is accessible via XSSCross-site Scripting (XSS) - Generic · medium
   12 votes
10. Goodhire Open RedirectDuplicateOpen Redirect
    11 votes
11. Information Disclosure and Privilege Escalation in app.goodhire.com/member/developers/api-settingsInformation Disclosure · high
    11 votes
12. Fake mailing reports using mail service on [URL : mail-txn.identity.com]low
    9 votes
13. Amount Manipulation Buy Unlimited Credits in just $1.00DuplicateInsecure Direct Object Reference (IDOR)
    8 votes
14. Reflected Cross-site Scripting Vulnerability via JSON Error MessageCross-site Scripting (XSS) - Reflected · low
    7 votes
15. Business Logic Flaw allowing Privilege EscalationInformativeBusiness Logic Errors
    7 votes
16. Malicious callback url can be set while creating application in identityBusiness Logic Errors · medium
    6 votes
17. No password confirmation on changing primary email addressInformativeImproper Access Control - Generic
    6 votes
18. HTTP Host Header Injection on app.goodhire.comDuplicateHTTP Response Splitting
    5 votes
19. Host Header Injection and Cache PoisoningDuplicateCRLF Injection
    4 votes
20. Limited Account Takeover via Backup codes DuplicateImproper Authentication - Generic
    3 votes
21. Host Header Injection or cache poisoning in multiple domainsN/ACRLF Injection
    2 votes
22. XST(Cross Site Tracing)Informative
    1 votes
23. Unsubscribe Any UserInformativeBusiness Logic Errors
    1 votes
24. Limited arbitrary text inclusion in user invite emailsInformativePhishing