Browse / Stripo Inc

Stripo Inc

See its reports on the map

Attack surface: 108 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Stripo Inc

• Access Control13
• Server-Side Request Forgery11
• Business Logic9
• Misconfiguration8
• Cross-site Scripting7
• Information Disclosure6

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Open memory dump method leaking customer information ,secret keys , password , source code & admin accountsExposed Dangerous Method or Function · critical
   158 votes
2. Public and secret api key leaked in JavaScript sourceCleartext Storage of Sensitive Information · medium
   148 votes
3. [Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.Improper Access Control - Generic · critical
   140 votes
4. [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to ZapierServer-Side Request Forgery (SSRF) · critical
   92 votes
5. stripo.email reflected xssCross-site Scripting (XSS) - Reflected · medium
   70 votes
6. No length on passwordImproper Authentication - Generic · medium
   64 votes
7. Able to change password by entering wrong old passwordCryptographic Issues - Generic
   56 votes
8. No rate limiting for subscribe email + lead to Cross origin misconfigurationBusiness Logic Errors · medium
   54 votes
9. Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]Business Logic Errors · high
   51 votes
10. [www.stripo.email] There is no rate limit for contact-us endpointsImproper Authorization · low
    47 votes
11. Bypassing Content-Security-Policy leads to open-redirect and iframe xssOpen Redirect · medium
    36 votes
12. subdomain takeover at status0.stripo.emailPrivilege Escalation · medium
    36 votes
13. [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.Improper Authorization · medium
    34 votes
14. Upload Profile Photo in any folder you want with any extension you wantPrivilege Escalation · critical
    33 votes
15. [SSRF] my.stripo.email via the setup-wizard parameterServer-Side Request Forgery (SSRF) · critical
    29 votes
16. Memory Dump and Env Disclosure via Spring Boot ActuatorMisconfiguration · medium
    27 votes
17. Stored XSS in the banner block descriptionCross-site Scripting (XSS) - Stored · medium
    25 votes
18. SSRF & unrestricted file upload on https://my.stripo.email/Server-Side Request Forgery (SSRF) · critical
    24 votes
19. Stored XSS at Module NameCross-site Scripting (XSS) - Stored · medium
    23 votes
20. weak password poilicy in signup password leak to account takeoverViolation of Secure Design Principles
    23 votes
21. SSRF external interactionServer-Side Request Forgery (SSRF) · low
    21 votes
22. Improper AuthorizationImproper Authorization · high
    20 votes
23. Password token leak via Host headerViolation of Secure Design Principles · medium
    20 votes
24. Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/Business Logic Errors · medium
    19 votes
25. Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on StripoCleartext Storage of Sensitive Information · medium
    19 votes
26. [demo.stripo.email] HTTP request SmugglingHTTP Request Smuggling · medium
    18 votes
27. No rate limiting - Create dataBusiness Logic Errors · medium
    18 votes
28. Bypass email verification and create email template with the editorImproper Access Control - Generic · high
    18 votes
29. No rate limit in email subscriptionBusiness Logic Errors · medium
    16 votes
30. subdomain takeover at status-stage0.stripo.emailPrivilege Escalation · medium
    16 votes
31. Ability to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referralBusiness Logic Errors · high
    15 votes
32. HTTP Request Smuggling on my.stripo.emailHTTP Request Smuggling · high
    15 votes
33. csrf bypass using flash file + 307 redirect method at plugins endpointCross-Site Request Forgery (CSRF) · medium
    15 votes
34. OLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGEImproper Authentication - Generic · medium
    15 votes
35. No Rate Limiting on /reset-password-request/ endpointViolation of Secure Design Principles · medium
    14 votes
36. Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on StripoCleartext Transmission of Sensitive Information · medium
    13 votes
37. Non-revoked API Key Information disclosure via Stripo_report()Cleartext Storage of Sensitive Information · medium
    13 votes
38. Stored XSS at "Conditions " through "My Custom Rule" Field at [https://my.stripo.email/cabinet/#/template-editor/] in Template Editor.Cross-site Scripting (XSS) - Stored · medium
    13 votes
39. Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKENImproper Access Control - Generic · high
    13 votes
40. CSRF - Modify Project SettingsCross-Site Request Forgery (CSRF) · critical
    13 votes
41. SSRF in Export template to ActiveCampaignServer-Side Request Forgery (SSRF) · medium
    13 votes
42. stripo blog search SQL InjectionSQL Injection · medium
    12 votes
43. No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email addressCross-Site Request Forgery (CSRF) · medium
    12 votes
44. Redirection through referer tagOpen Redirect · low
    12 votes
45. Permanent DOS for new users!InformativeUncontrolled Resource Consumption · high
    11 votes
46. SSRF in /cabinet/stripeapi/v1/siteInfoLookup?url=XXXServer-Side Request Forgery (SSRF) · medium
    11 votes
47. No rate limiting for confirmation email lead to huge Mass mailingsInformativeBusiness Logic Errors · medium
    9 votes
48. Unrestricted File Upload on https://my.stripo.email and https://stripo.emailUnrestricted Upload of File with Dangerous Type · medium
    9 votes
49. [www.stripo.email] You can bypass the speed limit by changing the IP.Information Exposure Through Debug Information · medium
    8 votes
50. Authorization for wp-admin directory are vulnerable to brute force.Improper Restriction of Authentication Attempts · high
    8 votes
51. Insecure Storage and Overly Permissive API KeysMissing Encryption of Sensitive Data · medium
    7 votes
52. No rate limiting - Create Plug-insBusiness Logic Errors · medium
    7 votes
53. Race condition on my.stripo.email at /cabinet/stripeapi/v1/projects/298427/emails/folders uriConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium
    7 votes
54. multiple email usage -my.stripo.email-Improper Access Control - Generic · medium
    7 votes
55. Blind SSRF while Creating TemplatesServer-Side Request Forgery (SSRF) · high
    7 votes
56. Information disclosure through Server side resource forgeryInformativeServer-Side Request Forgery (SSRF) · medium
    7 votes
57. Clickjacking on my.stripo.email for MailChimp credentials InformativeUI Redressing (Clickjacking) · medium
    7 votes
58. Stored XSS at Template Editor in "Section Name" Field of Block element 'Accordion'.Cross-site Scripting (XSS) - Stored · medium
    6 votes
59. Integer Overflow (CVE_2017_7529)Integer Overflow · medium
    6 votes
60. [www.stripo.email] There is no rate limit for /it/contact-us/ endpointsDuplicateImproper Authentication - Generic · low
    6 votes
61. SSRF in my.stripo.emailServer-Side Request Forgery (SSRF) · high
    6 votes
62. SSRF via Export Service in ActiveCampaignServer-Side Request Forgery (SSRF) · high
    6 votes
63. SSL cookie without secure flag setDuplicateMisconfiguration · medium
    6 votes
64. Email verification bypasaIncorrect Authorization · high
    5 votes
65. Tabnabbing in template comments - stripo.emailViolation of Secure Design Principles · low
    5 votes
66. XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect techniqueCross-Site Request Forgery (CSRF) · medium
    4 votes
67. my.stripo.emai email verification bypassed and also create email templatesReliance on Untrusted Inputs in a Security Decision · medium
    3 votes
68. SSRF leads to internal port scanServer-Side Request Forgery (SSRF) · low
    3 votes
69. Stored XSS in template comments.Cross-site Scripting (XSS) - Stored · medium
    3 votes
70. Able to download any hosted content on AWS S3 bucket(stripo)Improper Access Control - Generic · low
    3 votes
71. Strored Xss on https://my.stripo.email/ ( multiple inputs)Cross-site Scripting (XSS) - Stored · medium
    2 votes
72. CORS on my.stripo.emailInformativeMisconfiguration
    1 votes