Browse / Unikrn

Unikrn

See its reports on the map

Attack surface: 164 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Unikrn

• Cross-Site Request Forgery5
• Information Disclosure4
• Code Execution3
• Authentication3
• Open Redirect3
• Other weaknesses3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashierInsecure Direct Object Reference (IDOR) · high
   232 votes
2. Urgent: Server side template injection via Smarty template allows for RCECode Injection
   122 votes
3. Staging Rabbitmq instance is exposed to the internet with default credentialsImproper Authentication - Generic · low
   105 votes
4. Open URL RedirectionOpen Redirect · medium
   102 votes
5. ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com)Remote File Inclusion · low
   $2556 votes
6. [crm.unikrn.com] Open RedirectOpen Redirect · medium
   50 votes
7. Flash CSRF: Update Ad Frequency %: [cp-ng.pinion.gg]Cross-Site Request Forgery (CSRF) · medium
   33 votes
8. Escaping images directory in S3 bucket when saving new avatar, using Path Traversal in filenamePath Traversal · medium
   26 votes
9. CSRF in Raffles Ticket PurchasingCross-Site Request Forgery (CSRF) · high
   19 votes
10. Open Redirection leads to redirect Users to malicious websiteOpen Redirect
    $5018 votes
11. HTML injection in email in unikrn.comCommand Injection - Generic · high
    18 votes
12. CSRF log victim into the attacker accountCross-Site Request Forgery (CSRF) · high
    17 votes
13. Persistent XSS found on bin.pinion.gg due to outdated FlowPlayer SWF file with Remote File Inclusion vulnerability.Cross-site Scripting (XSS) - Generic · low
    17 votes
14. CSRF logs the victim into attacker's accountCross-Site Request Forgery (CSRF) · medium
    16 votes
15. █████████ on CRM server without authorizationImproper Access Control - Generic
    15 votes
16. Weak Session ID Implementation - No Session change on Password changeInsufficient Session Expiration · medium
    $4014 votes
17. Non-Cloudflare IPs allowed to access origin serversInformation Disclosure · medium
    $5014 votes
18. Path Disclosure Vulnerability http://crm.******.comInformation Disclosure · low
    12 votes
19. Lack of Input sanitization leads to database Character encoding configuration DisclosureInformation Exposure Through an Error Message · low
    $10011 votes
20. Improper validation at Phone verification (possible cost increase + SMS SPAM attack)Violation of Secure Design Principles · low
    10 votes
21. session_id is not being validated at email invitation endpointCross-Site Request Forgery (CSRF)
    8 votes
22. Rate Limit workaround in the message of the phone number verification Improper Restriction of Authentication Attempts · medium
    $1007 votes
23. multiple vulnerabilities on your mautic servermedium
    7 votes
24. bypass Claudflare access crm.mautic.comImproper Access Control - Generic
    7 votes
25. Rate-limit protection get executed in the last stage of the registration process, allowing enumeration of existing account.Violation of Secure Design Principles · low
    7 votes