Browse / Reverb.com

Reverb.com

See its reports on the map

What gets reported to Reverb.com

• Cross-site Scripting4
• Information Disclosure3
• Business Logic2
• Misconfiguration2
• Access Control1
• Cross-Site Request Forgery1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Full account takeoverImproper Access Control - Generic · high
   412 votes
2. Race Condition allows to redeem multiple times gift cards which leads to free "money"Business Logic Errors · high
   308 votes
3. Disclosure of all uploads to Cloudinary via hardcoded api secret in Android appInformation Disclosure · medium
   96 votes
4. Items bought for free due to lacks of quantity controlsBusiness Logic Errors · high
   41 votes
5. Persistent XSS in https://sandbox.reverb.com/item/Cross-site Scripting (XSS) - Stored · high
   36 votes
6. IDOR - Ability to view unlisted productsViolation of Secure Design Principles
   22 votes
7. Possible Blind Writing to S3 BucketViolation of Secure Design Principles
   17 votes
8. XSS in main search, use class tag to imitate Reverb.com core functionality, create false login windowCross-site Scripting (XSS) - Generic · medium
   16 votes
9. XSS in buying and selling pages, can created spoofed content (false login message)Cross-site Scripting (XSS) - Reflected · medium
   15 votes
10. Bypassing CSRF Token On Reply Message & Send MessageCross-Site Request Forgery (CSRF) · low
    14 votes
11. Basic auth details is still work on report ( 351555 ) Information Disclosure · low
    11 votes
12. Stored xss in shop name @ lp.reverb.comCross-site Scripting (XSS) - Stored · high
    10 votes
13. Api token exposed in Reverb.com's public github repositoryInformation Disclosure · medium
    7 votes