Browse / Mail.ru

Mail.ru

See its reports on the map

What gets reported to Mail.ru

• Cross-site Scripting291
• Information Disclosure141
• Authentication54
• Access Control50
• SQL Injection48
• Misconfiguration45

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Time-Based SQL injection at city-mobil.ruSQL Injection
   $15,000631 votes
2. touch.mail.ru / e.mail.ru memory content disclosureInformation Disclosure
   $10,000409 votes
3. Unrestricted file upload on [ambassador.mail.ru] Code Injection
   $3,000404 votes
4. Account Takeover worki.ruImproper Restriction of Authentication Attempts
   $1,700391 votes
5. Cross-organization data access in city-mobil.ruImproper Access Control - Generic
   $8,000374 votes
6. SQL injection at fleet.city-mobil.ruSQL Injection
   $10,000372 votes
7. Account TakeOver at my.33slona.ruImproper Restriction of Authentication Attempts
   $1,700359 votes
8. RCE on shared.mail.ru due to "widget" pluginCode Injection
   $10,000359 votes
9. SSRF & LFR via on city-mobil.ruRemote File Inclusion
   343 votes
10. [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious FileImproper Access Control - Generic
    340 votes
11. [windows10.hi-tech.mail.ru] Blind SQL Injection SQL Injection
    $5,000330 votes
12. [fleet.city-mobil.ru] Driver balance increasingBusiness Logic Errors
    319 votes
13. SSRF on fleet.city-mobil.ru leads to local file readServer-Side Request Forgery (SSRF)
    272 votes
14. XXE on pulse.mail.ruXML External Entities (XXE)
    $6,000264 votes
15. HTTP request smuggling (?) canpol.deti.mail.ruHTTP Request Smuggling
    $5,000241 votes
16. SSRF & LFR on city-mobil.ruServer-Side Request Forgery (SSRF)
    237 votes
17. Boolean-based SQL Injection on relap.ioSQL Injection
    227 votes
18. Blind SQL Injection in city-mobil.ru domainSQL Injection
    $2,000224 votes
19. file read on MCS servers via supplying a QCOW2 image with external backing fileInformation Disclosure
    $15,000222 votes
20. [panel.city-mobil.ru/admin/] Blind XSS into usernameCross-site Scripting (XSS) - Stored
    219 votes
21. SQL LIKE clauses wildcard injectionSQL Injection
    $8,000217 votes
22. Debug Mode Leak Critical Information [ AWS Keys , SMTP , Database , Django Secret Key ( RCE ) , Dodoc , Telegram , Twilio .. ]Information Disclosure
    205 votes
23. Cross application scripting via account.mail.ruCross-site Scripting (XSS) - Stored
    $5,000205 votes
24. read new emails from any inbox IOS APP in notification centerInsecure Direct Object Reference (IDOR)
    $10,000186 votes
25. Незащищённый экземпляр Zeppelin
    $35,000169 votes
26. JMX RMI command injection on 195.211.131.82(Mail.ru Gaming)Command Injection - Generic
    $2,000163 votes
27. SQL Injection [unauthenticated] with direct output at https://news.mail.ru/SQL Injection
    $7,500156 votes
28. Information disclosure with sensitive dataInformation Disclosure
    $1,500156 votes
29. Access to TarantoolImproper Access Control - Generic
    $4,000155 votes
30. Path traversal, SSTI and RCE on a MailRu acquisition Code Injection
    $2,000152 votes
31. [mcs.mail.ru] Пользователь с ролью наблюдателя может создавать ключи доступа для очереди сообщений (sqs.mcs.mail.ru)Improper Access Control - Generic
    $15,000147 votes
32. [c-api.city-mobil.ru] Client authentication bypass leads to information disclosureMissing Authentication for Critical Function
    143 votes
33. Account Takeover at worki.ruViolation of Secure Design Principles
    $1,500143 votes
34. Account Takeover at vseapteki.ruImproper Restriction of Authentication Attempts
    $2,000142 votes
35. Account TakeOver through password recovery at am.ruImproper Restriction of Authentication Attempts
    $3,000139 votes
36. XSS via message subject - mobile applicationCross-site Scripting (XSS) - DOM
    $1,000139 votes
37. PHP code injection at tz.mail.ruCode Injection
    $3,000137 votes
38. worki.ru: SMS code bruteforceBusiness Logic Errors
    $1,657136 votes
39. SSRF in clients.city-mobil.ruServer-Side Request Forgery (SSRF)
    $1,500132 votes
40. SSRF in filtering on relap.ioServer-Side Request Forgery (SSRF)
    130 votes
41. [api.pandao.ru] IDOR for order delivery addressInsecure Direct Object Reference (IDOR)
    $3,000125 votes
42. SMS Brute Force Possibility via https://youdrive.today/login/web/code can lead to Account TakeoverImproper Restriction of Authentication Attempts
    121 votes
43. "😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/Cross-site Scripting (XSS) - Stored
    118 votes
44. web.icq.com XSS in chat message via contact infoCross-site Scripting (XSS) - Stored
    116 votes
45. [agent.33slona.ru] Recovery code bruteforceImproper Restriction of Authentication Attempts
    104 votes
46. [city-mobil.ru] SSRF & limited LFR on /taxiserv/photoeditor/save endpoint via base64 POST parameterServer-Side Request Forgery (SSRF)
    95 votes
47. turboslim.lady.mail.ru - Blind sql-injection.SQL Injection
    $5,00093 votes
48. Open Selenoid instance at 188.93.63.186 leads to LFR/SSRF.Improper Access Control - Generic
    $6,00093 votes
49. Blind SSRF in horizon-heatServer-Side Request Forgery (SSRF)
    $2,50091 votes
50. Stored XSSCross-site Scripting (XSS) - Stored
    89 votes
51. Avatar upload allows arbitrary file overwritingPath Traversal
    $75088 votes
52. SQL injection on jd.mail.ruSQL Injection
    $30087 votes
53. Access User Tickets via IDOR in [widget.support.my.games]Insecure Direct Object Reference (IDOR)
    86 votes
54. capsula.mail.ru - Admin blind stored XSSCross-site Scripting (XSS) - Stored
    $1,50086 votes
55. 3igames.mail.ru SQL Injection SQL Injection
    $1,50086 votes
56. [app-01.youdrive.club] RCE in CI/CD via dependency confusionCommand Injection - Generic
    84 votes
57. Blind XSS in operator's interface for 33slona.ruCross-site Scripting (XSS) - Stored
    83 votes
58. Reflected XSS in https://light.mail.ru/login via pageCross-site Scripting (XSS) - Reflected
    83 votes
59. SQL injection delivery-club.ru (ClickHouse)SQL Injection
    $5,00076 votes
60. Возможность зайти на любой аккаунт https://pandao.ru/
    $2,60076 votes
61. [Mail.Ru Android] Typo in permission name allows to write contacts without user knowledgeImproper Access Control - Generic
    75 votes
62. Stored XSS in emailCross-site Scripting (XSS) - Stored
    75 votes
63. Path traversal lead to LFR via [CVE-2019-3394]Path Traversal
    74 votes
64. [https://city-mobil.ru/taxiserv] Blind XSS into usernameCross-site Scripting (XSS) - Stored
    74 votes
65. XSS via POST request to https://account.mail.ru/signup/Cross-site Scripting (XSS) - Reflected
    $1,00073 votes
66. Дюп предметов lootdog и возможность их продавать.Business Logic Errors
    $5,00073 votes
67. Stored XSS that allow an attacker to read victim mailboxes contacts in mail.ru and my.com applicationCross-site Scripting (XSS) - Stored
    71 votes
68. XSS via Cookie in Mail.ruCross-site Scripting (XSS) - Stored
    $1,00071 votes
69. [account.mail.ru] XSS-уязвимость в форме авторизацииCross-site Scripting (XSS) - DOM
    $1,00070 votes
70. [API] ICQ user's avatar can be manipulated remotelyImproper Input Validation
    $1,00070 votes
71. blind XXE in autodiscover parserXML External Entities (XXE)
    70 votes
72. reflected xss in e.mail.ruCross-site Scripting (XSS) - Reflected
    $1,00068 votes
73. Reflected XSS & Open Redirect at mcs main domainCross-site Scripting (XSS) - Reflected
    68 votes
74. Account takeover through password reset in cups.mail.ruInsecure Direct Object Reference (IDOR)
    68 votes
75. Cross-site Scripting (XSS) - DOM on https://account.mail.ru/user/garage?back_url=https://mail.ruCross-site Scripting (XSS) - DOM
    $1,00066 votes
76. web.icq.com XSS in chat message via contact infoCross-site Scripting (XSS) - Stored
    65 votes
77. SQL Injection at https://lite.r-keeper.ru/site_api/clients/derision/?lang=ruSQL Injection
    $1,50062 votes
78. [pandao.ru] Возможность списания несуществующих бонусных балловTime-of-check Time-of-use (TOCTOU) Race Condition
    58 votes
79. [web.icq.com] Stored XSS in Account NameCross-site Scripting (XSS) - Stored
    $1,00057 votes
80. HTML injection at face.city-mobil.ruImproper Input Validation
    $50057 votes
81. [tanks.mail.ru] SSRF + Кража cookie Cross-Site Request Forgery (CSRF)
    $75055 votes
82. Blind SQL in id_locality GET param on [city-mobil.ru/taxiserv]SQL Injection
    $3,50055 votes
83. XSS account.mail.ruCross-site Scripting (XSS) - Reflected
    $1,00054 votes
84. Blind SSRF in magnum upgrade_paramsServer-Side Request Forgery (SSRF)
    $2,50054 votes
85. XXE на webdav.mail.ru - PROPFIND/PROPPATCHXML External Entities (XXE)
    54 votes
86. Possibility to attach any mobile number to any emailImproper Authentication - Generic
    54 votes
87. Blind SQL Injection on news.mail.ruSQL Injection
    $3,00052 votes
88. Error in processing gif images
    $25052 votes
89. BLIND SSRF ON http://jsgames.mail.ru via avaOp parameter Server-Side Request Forgery (SSRF)
    49 votes
90. IDOR of users Insecure Direct Object Reference (IDOR)
    $50048 votes
91. molotok.m.mail.ru delegated to external entityExternally Controlled Reference to a Resource in Another Sphere
    $1,50048 votes
92. Stored XSS on store.my.gamesCross-site Scripting (XSS) - Stored
    $20047 votes
93. [my.games, lootdog.io] XSS via MCS BucketCross-site Scripting (XSS) - Stored
    $1,33347 votes
94. [smena.samokat.ru] Predictable JWT secretInadequate Encryption Strength
    47 votes
95. informations disclosure(Email,Numbers,Agreements, admin Sessions and more ...) through a PostgreSQL database belongs to (legium-back.corp.mail.ru)Information Disclosure
    46 votes
96. Cross-site Scripting (XSS) - StoredCross-site Scripting (XSS) - Stored
    45 votes
97. [city-mobil.ru/taxiserv/] SQLi at /taxiserv/tariffs/dictionary at filter{"id_locality"} paramSQL Injection
    44 votes
98. SSRFServer-Side Request Forgery (SSRF)
    44 votes
99. Stored XSS when you read eamils. <style>Cross-site Scripting (XSS) - Stored
    $1,00044 votes
100. blog/wp-json/wp/v2/users FILE is enable it will used for bruteforce attack the admin panel at blog/wp-login.phpImproper Restriction of Authentication Attempts
     43 votes