HexBrain
Sign in

Browse / Mars

Mars

68disclosed reports

See its reports on the map

What gets reported to Mars

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Account Takeover in Password Reset FunctionAuthentication Bypass · critical
    105 votes
  2. Reflected HTML Injection via contact (faq) search parameter on ██████████Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
    103 votes
  3. █████████ when adding branches to your accountInsecure Direct Object Reference (IDOR) · critical
    98 votes
  4. Reflected HTML Injection via contact (faq) search parameter on ███]=Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
    82 votes
  5. Unrestricted File Upload at ██████████Unrestricted Upload of File with Dangerous Type · critical
    78 votes
  6. sqli on █████████ search functionalitySQL Injection · medium
    72 votes
  7. RXSS on ██████ via customerId parameterCross-site Scripting (XSS) - Reflected · medium
    71 votes
  8. CVE-█████-35813 in █████Relative Path Traversal · critical
    71 votes
  9. Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314Information Disclosure · medium
    67 votes
  10. Upload profile photo and Pets addition - IDORInsecure Direct Object Reference (IDOR) · high
    66 votes
  11. Bug Report #23JAN136 (subdomain takeover via shopify )Privilege Escalation · high
    63 votes
  12. SQLi At `███████` via `theme_name` SQL Injection · critical
    62 votes
  13. Attacker can add two free bags offered by the site at the same time.Business Logic Errors · medium
    62 votes
  14. Insecure API Response Leads to Disclosure of Hashed PasswordsInformation Disclosure · medium
    61 votes
  15. CSRF to delete a pet on ██████Cross-Site Request Forgery (CSRF) · low
    61 votes
  16. insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)Deserialization of Untrusted Data · critical
    59 votes
  17. 0 Click account takeover via timed requests to ███████forgot-password (single-packet attack)Use of a Broken or Risky Cryptographic Algorithm · high
    58 votes
  18. [XSS] Reflected XSS via POST request in (███████)Cross-site Scripting (XSS) - Reflected · medium
    54 votes
  19. unauthorized access and add user and change personal information all usersImproper Access Control - Generic · critical
    54 votes
  20. change part of personal information all usersImproper Access Control - Generic · critical
    53 votes
  21. RXSS on ████ via configUrl parameterCross-site Scripting (XSS) - Reflected · low
    53 votes
  22. Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████Improper Authentication - Generic · critical
    53 votes
  23. phpinfo() exposed on ██████████Misconfiguration · medium
    51 votes
  24. Bug Report #23JAN135 (subdomain takeover via shopify )Privilege Escalation · high
    50 votes
  25. Publicly accessible `█████████` endpoint exposing internal user identifiers and email addressesInformation Disclosure · medium
    49 votes
  26. Sqli on ██████ search functionalitySQL Injection · medium
    47 votes
  27. Datadog api keys exposed can be used to do all the read and write access to the instanceInformation Disclosure · critical
    47 votes
  28. unsubscribe anyone from all ████████ emails @ █████Improper Access Control - Generic · low
    45 votes
  29. IDOR to account takeover on POST to █████████ by changing member_id parameterInsecure Direct Object Reference (IDOR) · critical
    45 votes
  30. IDOR in one subdomain of █████████ -> change information of pets without athorization!Insecure Direct Object Reference (IDOR) · medium
    45 votes
  31. SQLi at █████ parameterSQL Injection · critical
    42 votes
  32. Account takeover using reset password linkOpen Redirect · medium
    41 votes
  33. debug.log leaked [█████████]Information Disclosure · low
    40 votes
  34. Users Data Exposure via Insecure EndpointInformation Disclosure · medium
    40 votes
  35. RXSS on stores on *█████████/visitorRegistration.pml via destination parameterCross-site Scripting (XSS) - Reflected · medium
    40 votes
  36. subdomain takeover at █████████Misconfiguration · high
    40 votes
  37. Client Side Template Injection to Stored XSS in Image CollectionCross-site Scripting (XSS) - Stored · high
    39 votes
  38. RXSS on ████ via q parameterCross-site Scripting (XSS) - Reflected · low
    39 votes
  39. debug.log File Exposure that exposes (user/████) username and password at █████████Cleartext Storage of Sensitive Information · high
    39 votes
  40. RXSS in ███ via S parameter Cross-site Scripting (XSS) - Reflected · medium
    38 votes
  41. massive PII leakage for ███████Insecure Storage of Sensitive Information · medium
    36 votes
  42. phpinfo() exposed on ██████████Misconfiguration
    36 votes
  43. Sensitive information exposed at [███] via /export_panelists_to_xlsx endpointCleartext Storage of Sensitive Information · medium
    35 votes
  44. Reflected xss on ████████ Cross-site Scripting (XSS) - Reflected · medium
    33 votes
  45. Sensitive Information Exposed at █████Information Disclosure · high
    33 votes
  46. Order More Than Maximum Allowed QuantityBusiness Logic Errors
    32 votes
  47. CSRF in Delete Pet FunctionCross-Site Request Forgery (CSRF) · medium
    32 votes
  48. ████ ' can change any account email and cannot retrieve his account and access it ' at ███Insecure Direct Object Reference (IDOR) · high
    32 votes
  49. CVE-2022-21371: Oracle WebLogic Server Local File InclusionPath Traversal · high
    30 votes
  50. ███████ - Publicly Accessible public_html Directory Exposing WordPress ConfigurationInformation Disclosure · medium
    29 votes
  51. CSRF resulting in adding pet at ███████Cross-Site Request Forgery (CSRF) · low
    29 votes
  52. Blind SQL Injection on █████ via URI PathSQL Injection · critical
    29 votes
  53. No CSRF protection when adding an item to cartCross-Site Request Forgery (CSRF) · low
    29 votes
  54. No Rate Limiting on Password Attempts After Insecure Registration Flow cause ATOImproper Restriction of Authentication Attempts · medium
    28 votes
  55. Customer Data Exposure via Insecure Endpoint of couponInformation Disclosure · medium
    28 votes
  56. sensitive data-creds for database - private keyMissing Encryption of Sensitive Data · medium
    27 votes
  57. ████ ' can add animal to other account ' at ██████Insecure Direct Object Reference (IDOR) · medium
    27 votes
  58. **"CSRF Vulnerability in ███████ Website Allows Attackers to Change User Profile Picture at ███████"**Cross-Site Request Forgery (CSRF) · medium
    26 votes
  59. Reflected XSS on formaction parameterCross-site Scripting (XSS) - Reflected · medium
    25 votes
  60. CSRF to delete a petCross-Site Request Forgery (CSRF) · medium
    25 votes
  61. Information Exposure due to enabled debug modeInformation Disclosure · low
    22 votes
  62. ███████ ' can delete any animal from other account ' at ██████████ Insecure Direct Object Reference (IDOR) · medium
    21 votes
  63. ' Full Account Takeover ' at █████Improper Access Control - Generic · critical
    19 votes
  64. Stored XSS via ' profile ' at ███Cross-site Scripting (XSS) - Stored · medium
    16 votes
  65. CRLF Inection at `██████████`CRLF Injection · low
    14 votes
  66. Information Exposure Through Directory ListingInformation Exposure Through Directory Listing · high
    13 votes
  67. Jolokia Reflected XSS Cross-site Scripting (XSS) - Reflected · medium
    13 votes
  68. Google dork lead to unsubscribe anyone from all Banfield emailsImproper Access Control - Generic · low
    12 votes