HexBrain
Sign in

Browse / Vanilla

Vanilla

40disclosed reports
$10,000paid in bounties

See its reports on the map

What gets reported to Vanilla

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Abusing "Report as abuse" functionality to delete any user's post.Business Logic Errors
    $300160 votes
  2. XSS: Group search termsCross-site Scripting (XSS) - DOM
    105 votes
  3. Stored XSS in vanillaCross-site Scripting (XSS) - Stored
    $30089 votes
  4. Stored XSS in vanillaCross-site Scripting (XSS) - Stored
    $30088 votes
  5. Vanilla Forums AddonManager getSingleIndex Directory Traversal File Inclusion Remote Code Execution VulnerabilityPath Traversal
    $90084 votes
  6. A SQL injection vulnerability in VanillaSQL Injection
    $60051 votes
  7. Web cache deception attack on https://open.vanillaforums.com/messages/allInformation Disclosure
    $15047 votes
  8. Vanilla SQL Injection VulnerabilitySQL Injection
    $60045 votes
  9. disclosure of email by sending a message.Information Disclosure
    $15042 votes
  10. XSS through chat messagesCross-site Scripting (XSS) - Generic
    $30040 votes
  11. Vanilla Forums ImportController index file_exists Unserialize Remote Code Execution VulnerabilityDeserialization of Untrusted Data
    $60039 votes
  12. jsConnect Plugin: Takeover of existing accountImproper Authentication - Generic
    $30035 votes
  13. BlIND XSS on https://open.vanillaforums.comCross-site Scripting (XSS) - DOM
    $30033 votes
  14. XSS For Profile NameCross-site Scripting (XSS) - Stored
    $30032 votes
  15. Vanilla Forums domGetImages getimagesize Unserialize Remote Code Execution Vulnerability (critical)Deserialization of Untrusted Data
    $60032 votes
  16. Unsanitized user photo paths allow local file readBusiness Logic Errors
    $30031 votes
  17. Persistent XSS via SignaturesCross-site Scripting (XSS) - Stored
    $30028 votes
  18. [allhiphop.vanillacommunities.com] XSS Request-URICross-site Scripting (XSS) - Reflected
    $10028 votes
  19. Vanilla Forums Gdn_Format unserialize() Remote Code Execution VulnerabilityDeserialization of Untrusted Data
    $60025 votes
  20. Vanilla Forums Xenforo password splitHash Unserialize Remote Code Execution VulnerabilityDeserialization of Untrusted Data
    $30024 votes
  21. FileUpload Plugin: CSRF (delete all attached files)Cross-Site Request Forgery (CSRF)
    $30024 votes
  22. Accessing Private Files Shared in message of other usersImproper Access Control - Generic
    24 votes
  23. A user can comment in private discussions without having permission to access the discussionBusiness Logic Errors
    23 votes
  24. Overwrite Drafts of Everyone Improper Access Control - Generic
    22 votes
  25. Forum Users Information DisclosureInformation Disclosure
    $30018 votes
  26. Unsanitized input in email fieldCross-site Scripting (XSS) - Stored
    $30017 votes
  27. xss reflected in littleguy.vanillastaging.comCross-site Scripting (XSS) - Reflected
    $30014 votes
  28. CORS Misconfiguration on vanillaforums.com Misconfiguration
    13 votes
  29. Stored XSS in Rich editor via Embed datetimeCross-site Scripting (XSS) - Stored
    $30013 votes
  30. Making further registrations difficult on Vanilla forumUncontrolled Resource Consumption
    $15013 votes
  31. Homograph attack bypass cause redirectionOpen Redirect
    12 votes
  32. A user can create an event in a group without being in it http://littleguy.vanillastaging.com/Improper Access Control - Generic
    12 votes
  33. Spoofing the redirect process using RTLOViolation of Secure Design Principles
    $1509 votes
  34. Hidden Stored XSS in nested post embedsCross-site Scripting (XSS) - Stored
    $1508 votes
  35. Bypassing the Trusted Link Alert SystemUI Redressing (Clickjacking)
    8 votes
  36. Able to Select Every Poll Option[http://tedwebers-famous-loudspeakers.vanillacommunities.com]Privilege Escalation
    $1508 votes
  37. Stored XSS in Profile CommentsCross-site Scripting (XSS) - Stored
    $3005 votes
  38. Conversation API Leaks Details Of UnAuthorized ConversationsImproper Access Control - Generic
    $1504 votes
  39. Stored XSS in embedded posts containing imagesCross-site Scripting (XSS) - Stored
    $1504 votes
  40. Stealing the ip addres from usersInformation Disclosure
    2 votes