Browse / Mixmax

Mixmax

See its reports on the map

What gets reported to Mixmax

• Cross-site Scripting5
• Authentication4
• Server-Side Request Forgery2
• Access Control2
• Misconfiguration2
• Information Disclosure2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SSRF via webhookServer-Side Request Forgery (SSRF)
   20 votes
2. Privilege escalation-User who does not have access is able to add notes to the contactPrivilege Escalation · high
   13 votes
3. app.mixmax.com Information Discloure on cal.mixmax.com and Not Signing out after Removing information grant access from GoogleImproper Authentication - Generic · medium
   12 votes
4. Clickjacking on Mixmax.comUI Redressing (Clickjacking) · high
   12 votes
5. [app.mixmax.com] Stored XSS on Adding new enhancement.Cross-site Scripting (XSS) - Stored · medium
   11 votes
6. Public calendar link can be invisibleInformation Disclosure · low
   9 votes
7. Blind SSRF due to img tag injection in career formServer-Side Request Forgery (SSRF) · low
   9 votes
8. CSRFCross-Site Request Forgery (CSRF) · high
   9 votes
9. CRLF Injection on https://vpn.mixmax.comCRLF Injection · low
   8 votes
10. Stored XSS in Templates>Enahance>Social BadgesCross-site Scripting (XSS) - Stored
    7 votes
11. Missing restriction on string size of contact fieldViolation of Secure Design Principles · low
    7 votes
12. [compose.mixmax.com] Stored XSS on compose.mixmax.com in contact names.Cross-site Scripting (XSS) - Stored · high
    7 votes
13. Subdomain takeover (sales.mixmax.com)Privilege Escalation · medium
    7 votes
14. no string size restriction on team nameMemory Corruption - Generic · low
    6 votes
15. Email Leakage in staging environmentInformation Disclosure
    6 votes
16. Possible Subdomain TakeoverInsufficiently Protected Credentials · medium
    6 votes
17. mailbomb through invite feature on chrome addonImproper Restriction of Authentication Attempts · medium
    6 votes
18. Design issue with webhook (several) notifications on mixmax.com
    4 votes
19. Stored XSS templates -> 'call for action' featureCross-site Scripting (XSS) - Stored · high
    4 votes
20. Security Vulnerability - SMTP protection not usedlow
    4 votes
21. Attacker can trick other into logging in as themselvesImproper Authentication - Generic · medium
    4 votes