Browse / QIWI

QIWI

See its reports on the map

What gets reported to QIWI

• Cross-site Scripting20
• Information Disclosure14
• Authentication12
• Code Execution8
• Other weaknesses6
• Injection and Smuggling5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SQL injection on contactws.contact-sys.com in TScenObject action ScenObjects leads to remote code executionCode Injection
   475 votes
2. Unauthenticated SSRF in jira.tochka.com leading to RCE in confluence.bank24.intCode Injection
   221 votes
3. Remote Code Execution on contactws.contact-sys.com via SQL injection in TCertObject operation "Delete"Code Injection
   194 votes
4. MobileIron Unauthenticated RCE on mdm.qiwi.com with WAF bypassDeserialization of Untrusted Data
   148 votes
5. SQL injection on contactws.contact-sys.com in TRateObject.AddForOffice in USER_ID parameter leads to remote code executionCode Injection
   118 votes
6. account takeover https://qiwi.me Improper Authentication - Generic
   106 votes
7. account takeover https://idea.qiwi.com/ Session Fixation
   87 votes
8. Remote Code Execution on contactws.contact-sys.com via SQL injection in TAktifBankObject.GetOrder in parameter DOC_IDCode Injection
   84 votes
9. SSRF на https://qiwi.com с помощью "Prerender HAR Capturer"Server-Side Request Forgery (SSRF)
   77 votes
10. DOM XSS triggered in secure support deskCross-site Scripting (XSS) - DOM
    66 votes
11. account takeover through password reset in url https://reklama.tochka.com/Improper Authentication - Generic
    57 votes
12. Обход комиссии на переводыBusiness Logic Errors
    56 votes
13. XXE on ██████████ by bypassing WAF ████XML External Entities (XXE)
    53 votes
14. Remote Code Execution on contactws.contact-sys.com via SQL injection in TPrabhuObject.BeginOrder in parameter DOC_IDCode Injection
    52 votes
15. [contact-sys.com] SQL Injection████ limit paramSQL Injection
    50 votes
16. apache access.log leakage via long request on https://rapida.ru/Buffer Over-read
    42 votes
17. XML External Entity (XXE) in qiwi.com + waf bypassXML External Entities (XXE)
    41 votes
18. account takeover https://teamplay.qiwi.comImproper Authentication - Generic
    40 votes
19. account impersonate through broken linkPhishing
    39 votes
20. PIN OK attackBusiness Logic Errors
    39 votes
21. [qiwi.me] Stored XSSCross-site Scripting (XSS) - Stored
    37 votes
22. [p2p.qiwi.com] nginx alias traversalInformation Disclosure
    34 votes
23. gifts.flocktory.com/phpmyadmin is vulnerable csrfCross-Site Request Forgery (CSRF)
    32 votes
24. Обход комиссии при оплате картой
    32 votes
25. [lk.contact-sys.com] SQL Injection reset_password FP_LK_USER_LOGINSQL Injection
    32 votes
26. XSS https://agent.postamat.tech/ в профиле + дисклоз секретной информацииCross-site Scripting (XSS) - Generic
    31 votes
27. mysql.initial.sql file is accessable for everyoneInformation Disclosure
    30 votes
28. Account takeover just through csrf in https://booking.qiwi.kz/profileImproper Access Control - Generic
    30 votes
29. HTTP Request Smuggling on api.flocktory.com Leads to XSS on Customer SitesHTTP Request Smuggling
    29 votes
30. [qiwi.com] XSS on payment formCross-site Scripting (XSS) - Reflected
    28 votes
31. Account Takeover through registration to the same email addressImproper Authentication - Generic
    26 votes
32. CVE-2020-3187 - unauthenticated arbitrary file deletion in CiscoPath Traversal
    26 votes
33. [QIWI Wallet] Access to protected app components Privilege Escalation
    26 votes
34. Обход комиссии на переводы
    21 votes
35. [*.rocketbank.ru] Web Cache Deception & XSSCross-site Scripting (XSS) - Stored
    21 votes
36. [lk.contact-sys.com] LKlang Path TraversalPath Traversal
    21 votes
37. [contact-sys.com] XSS /ajax/transfer/status trn paramCross-site Scripting (XSS) - Generic
    21 votes
38. IDOR редактирование любого вишлистаInsecure Direct Object Reference (IDOR)
    19 votes
39. [id.rapida.ru] Full Path DisclosureInformation Disclosure
    19 votes
40. crlf injection на https://bug.qiwi.comCRLF Injection
    18 votes
41. Небезопасная схема выдачи номера карты QVC (возможно, также QVV и QVP)Information Disclosure
    18 votes
42. [send.qiwi.ru] Soap-based XXE vulnerability /soapserver/ Uncontrolled Resource Consumption
    18 votes
43. Возможность регистрации на сайте qiwi.com на любой номер телефонаBusiness Logic Errors
    17 votes
44. Information disclosure on https://paycard.rapida.ruInformation Disclosure
    17 votes
45. [wallet.rapida.ru] XSS Cookie flashcookieCross-site Scripting (XSS) - Generic
    17 votes
46. [qiwi.com] Oauth захват аккаунтаImproper Authentication - Generic
    17 votes
47. broken authentication (password reset link not expire after use in https://network.tochka.com/sign-up)Weak Password Recovery Mechanism for Forgotten Password
    16 votes
48. [sms.qiwi.ru] XSS via Request-URICross-site Scripting (XSS) - Generic
    16 votes
49. https://fundl.qiwi.com CSRF на подтверждении sms Cross-Site Request Forgery (CSRF)
    15 votes
50. [ibank.qiwi.ru] XSS via Request-URICross-site Scripting (XSS) - Generic
    15 votes
51. Слив какого-то access токена
    14 votes
52. Каким-то образом получил чужой платеж к себе на копилку https://qiwi.me/undefined
    14 votes
53. [contact-sys.com] XSS via Request-URICross-site Scripting (XSS) - Generic
    14 votes
54. Imformation Disclosure on id.rapida.ruInformation Disclosure
    13 votes
55. Subdomain Takeover on 1c-start.tochka.com pointing to unbouncepagesPrivilege Escalation
    12 votes
56. Nickname disclosure through web-chatInformation Disclosure
    12 votes
57. [qiwi.me] No limits on image download requestsServer-Side Request Forgery (SSRF)
    12 votes
58. [XSS/pay.qiwi.com] Pay SubDomain Hard-Use XSSCross-site Scripting (XSS) - Generic
    12 votes
59. [vitrina.contact-sys.com] Full Path DisclosureInformation Disclosure
    12 votes
60. [qiwi.com] Information DisclosureInformation Disclosure
    12 votes
61. hard-use account takeover qiwi.comImproper Authentication - Generic
    11 votes
62. [qiwi.com] .bash_historyInformation Disclosure
    11 votes
63. Раскрытие чувствительной информации composer.lock docker-compose.yml Information Disclosure
    9 votes
64. какой-то исходный код в корне сайта
    8 votes
65. [XSS/3dsecure.qiwi.com] 3DSecure XSSCross-site Scripting (XSS) - Generic
    8 votes
66. Раскрытие баланса на //kopilka.qiwi.comInformation Disclosure
    8 votes
67. Xss on billingCross-site Scripting (XSS) - Generic
    8 votes
68. [rubm.qiwi.com] Yui charts.swf XSSCross-site Scripting (XSS) - Generic
    8 votes
69. Open Redirect in meeting.qiwi.comOpen Redirect
    8 votes
70. disclosing clients' secret keys https://stage-uapi.tochka.com:2000/Information Disclosure
    7 votes
71. Stored xss in agent.qiwi.comCross-site Scripting (XSS) - Generic
    7 votes
72. [ibank.qiwi.ru] UI Redressing via Request-URIViolation of Secure Design Principles
    6 votes
73. [z.tochka.com] Unlimited file uploads lead to malware executedMalware
    5 votes
74. Content Spoofing in mango.qiwi.comImproper Authentication - Generic
    5 votes
75. Открытый доступ к корпоративным данным.Improper Authentication - Generic
    5 votes
76. Session Cookie without HttpOnly and secure flag setViolation of Secure Design Principles
    5 votes
77. [qiwi.com] Open RedirectOpen Redirect
    5 votes
78. Keychain data persistence may lead to account takeoverInsufficient Session Expiration
    4 votes
79. https://teamplay.qiwi.com/ накрутка баллов => финансовые убытки для компании
    3 votes
80. [wallet.rapida.ru] Mass SMS floodImproper Restriction of Authentication Attempts
    3 votes
81. [ishop.qiwi.com] XSS + MisconfigurationCross-site Scripting (XSS) - Generic
    3 votes
82. Metadata in hosted files is disclosing Usernames, Printers, paths, admin guides. emailsInformation Disclosure
    3 votes
83. SSL Certificate on qiwi.com will expire soon.Cryptographic Issues - Generic
    2 votes
84. [qiwi.com] /oauth/confirm.action XSSCross-site Scripting (XSS) - Generic
    2 votes
85. CRLF Injection [ishop.qiwi.com]CRLF Injection
    2 votes
86. Code for registration of qiwi account is not coming even after a long interval of time for Indian mobile numberViolation of Secure Design Principles
    2 votes
87. [static.qiwi.com] XSS proxy.htmlCross-site Scripting (XSS) - Generic
    2 votes
88. XSS Reflected in test.qiwi.ruCross-site Scripting (XSS) - Generic
    1 votes
89. [send.qiwi.ru] XSS at auth?login=Cross-site Scripting (XSS) - Generic
    1 votes