HexBrain
Sign in

Browse / Weblate

Weblate

158disclosed reports

See its reports on the map

What gets reported to Weblate

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. **Unauthenticated IDOR allows modification of payment customer billing information**Insecure Direct Object Reference (IDOR) · high
    72 votes
  2. exposure of personal IP address via email.Privacy Violation
    61 votes
  3. SSRF via URL Parser Differential in `normalize_request_url` (wlc)Server-Side Request Forgery (SSRF) · high
    43 votes
  4. Reset password cookie leads to account takeoverReliance on Cookies without Validation and Integrity Checking in a Security Decision · medium
    41 votes
  5. Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command executionOS Command Injection · high
    34 votes
  6. Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on WeblateInformation Disclosure
    34 votes
  7. Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in WeblateUncontrolled Resource Consumption · high
    33 votes
  8. Billion laughs entity expansion in Qt .ts discovery: a crafted ~950 KB file forces ~55 MB of XML expansion per parse, cost scales with crafted file cXML Entity Expansion · medium
    29 votes
  9. CSRF with logout actionCross-Site Request Forgery (CSRF)
    29 votes
  10. no captcha for register user and weak question attacker can spam emailViolation of Secure Design Principles
    29 votes
  11. API token sent to URL dictated by an untrusted project .weblate fileInformation Disclosure · medium
    27 votes
  12. Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`Uncontrolled Resource Consumption · medium
    24 votes
  13. Open Github Repo Leaking WEBLATE SECRET KEYCleartext Storage of Sensitive Information
    22 votes
  14. Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.Path Traversal · medium
    21 votes
  15. Race Condition allows to get more free trials and get more than 100 languages and strings for freeBusiness Logic Errors · low
    20 votes
  16. HTML injection and information disclosure in support panelInformation Disclosure · medium
    20 votes
  17. Broken Authentication – Session Token bugImproper Authentication - Generic
    19 votes
  18. Uploaded XLF files result in External Entity ExecutionXML External Entities (XXE) · high
    18 votes
  19. Rate Limit Bypass on login PageImproper Authentication - Generic · medium
    18 votes
  20. Uncaught RecursionError crash in translation-finder (deep directory tree DoS)Uncontrolled Resource Consumption · low
    16 votes
  21. Insecure Account Removal #2Violation of Secure Design Principles · low
    16 votes
  22. wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.Information Exposure Through an Error Message · low
    14 votes
  23. CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matchingUncontrolled Resource Consumption · medium
    13 votes
  24. No rate limiting for Remove Account lead to huge Mass mailingsBusiness Logic Errors
    13 votes
  25. DKIM records not present, Email Hijacking is possible.....Improper Authentication - Generic
    12 votes
  26. Password RestrictionViolation of Secure Design Principles · low
    12 votes
  27. Translation discovery crashes on crafted filenames (regex substitution injection)Use of Externally-Controlled Format String · low
    11 votes
  28. Stored XSS via Create Project (Add new translation project)Cross-site Scripting (XSS) - Stored · medium
    11 votes
  29. No Rate On Add SuggestConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low
    11 votes
  30. flood of comment no rate limit on commnets >> by using different user agent Violation of Secure Design Principles · low
    11 votes
  31. no notification send to victim if attacker hacks/accesses his victims WebLate account.Business Logic Errors · low
    11 votes
  32. Login CSRF : Login Authentication FlawCross-Site Request Forgery (CSRF) · medium
    11 votes
  33. Account Takeover using Third party Auth CSRFCross-Site Request Forgery (CSRF) · high
    11 votes
  34. Logging in without knowing credentials after logged out actionImproper Authentication - Generic
    10 votes
  35. Rate Limit Issue on hosted.weblate.orgImproper Restriction of Authentication Attempts · low
    10 votes
  36. Weak password policyImproper Authentication - Generic · low
    10 votes
  37. Weak e-mail change functionality could lead to account takeoverViolation of Secure Design Principles · low
    10 votes
  38. No rate Limit on Add new Translation Project Improper Restriction of Authentication Attempts
    9 votes
  39. Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/registerViolation of Secure Design Principles
    9 votes
  40. Insecure Account RemovalViolation of Secure Design Principles · low
    9 votes
  41. Activation tokens are not expiringCross-Site Request Forgery (CSRF) · medium
    9 votes
  42. Testing flow includes a DeepSource secretUse of Hard-coded Credentials · low
    8 votes
  43. Missing Restriction On String SizeMemory Corruption - Generic
    8 votes
  44. Reset password more than once with a reset link #2Business Logic Errors
    8 votes
  45. Running 2 accounts with a single email #3Business Logic Errors
    8 votes
  46. Reset password more than once with a reset linkBusiness Logic Errors
    8 votes
  47. No Rate Limiting at /contactMemory Corruption - Generic · low
    8 votes
  48. Invalidate session after password reset - hosted websiteDuplicateImproper Authentication - Generic · low
    8 votes
  49. No Password Length Restriction leads to Denial of ServiceUncontrolled Resource Consumption · low
    8 votes
  50. Improper access control when an added email address is deleted from authenticationDuplicateImproper Access Control - Generic · high
    8 votes
  51. No BruteForce ProtectionImproper Restriction of Authentication Attempts · medium
    8 votes
  52. Registration captcha bypassViolation of Secure Design Principles · medium
    8 votes
  53. Stored XSS @ /engage/<project_slug>Cross-site Scripting (XSS) - Stored · medium
    7 votes
  54. Browser Self XSS Protection not implementedInformation Disclosure
    7 votes
  55. Password token validation in Weblate Bypass #2Improper Authentication - Generic
    7 votes
  56. Running 2 accounts with a single email [Part 2]Business Logic Errors
    7 votes
  57. Weblate |Security Misconfiguration| Method Enumeration Possible on domain Misconfiguration
    7 votes
  58. Takeover of an account via reset password options after removing the accountImproper Authentication - Generic · low
    7 votes
  59. Information Disclosure on demo.weblate.orgInformation Disclosure · low
    7 votes
  60. Captcha Bypass at Email Reset can lead to Spamming users.Violation of Secure Design Principles
    7 votes
  61. Design Flaw in session management of password reset Improper Access Control - Generic
    7 votes
  62. CSRF to Connect third party AccountCross-Site Request Forgery (CSRF) · medium
    7 votes
  63. Running 2 accounts with a single emailBusiness Logic Errors
    7 votes
  64. Missing restriction on string size of Full Name at https://demo.weblate.org/accounts/register/Memory Corruption - Generic · low
    7 votes
  65. CSV Injection with the CSV export featureOS Command Injection · low
    7 votes
  66. CSRF : Reset API Cross-Site Request Forgery (CSRF) · low
    7 votes
  67. Logout CSRFCross-Site Request Forgery (CSRF) · low
    7 votes
  68. Secret_key in GitHubInformativeInformation Disclosure
    6 votes
  69. 2nd issue>>> flood of email no rate limit on delete account confirmation email >> Violation of Secure Design Principles · low
    6 votes
  70. Application allowing old password to be set as new password | hosted.weblate.orgImproper Authentication - Generic
    6 votes
  71. Improper validation of unicode characters #3
    6 votes
  72. Persistence of Third Party Association.Business Logic Errors
    6 votes
  73. Full Name Overwrite on Third party loginImproper Authentication - Generic
    6 votes
  74. Old password can be new passwordImproper Authentication - Generic · low
    6 votes
  75. CSV export filter bypass leads to formula injection.Command Injection - Generic · medium
    6 votes
  76. No Rate Limitting at Change PasswordImproper Restriction of Authentication Attempts · medium
    6 votes
  77. [hosted.weblate.org]Account TakeoverImproper Authentication - Generic · low
    6 votes
  78. Open SMTP port can let anyone send email from mail.chihar.comN/ACryptographic Issues - Generic
    6 votes
  79. Login using disconnected google account i.e login using old email idImproper Authentication - Generic · low
    6 votes
  80. You can simply just use passwords that simply are as 123456Improper Authentication - Generic · low
    6 votes
  81. Send Empty CSRF leads to log out user on [https://hosted.weblate.org/accounts/profile]Cross-Site Request Forgery (CSRF) · low
    5 votes
  82. No Rate Limit On Add new wordBusiness Logic Errors · low
    5 votes
  83. Tab nabbing via window.opener
    5 votes
  84. Add another email address without verificationImproper Access Control - Generic
    5 votes
  85. Password token validation in Weblate BypassImproper Authentication - Generic
    5 votes
  86. No Rate Limitation on Regenerate Api KeyImproper Restriction of Authentication Attempts
    5 votes
  87. Improper validation of unicode characters still not fixed #2
    5 votes
  88. The username of an account can be ..Business Logic Errors
    5 votes
  89. Improper validation of unicode charactersViolation of Secure Design Principles
    5 votes
  90. Improper validation of unicode characters still not fixed
    5 votes
  91. Open redirect while disconnecting EmailOpen Redirect
    5 votes
  92. Improper Cookie expiration | Cookies Expiration Set to Future Misconfiguration · low
    5 votes
  93. Option method enabledViolation of Secure Design Principles
    5 votes
  94. Missing restriction on string sizelow
    5 votes
  95. Self-XSS can be achieved in the editor link using filter bypassCross-site Scripting (XSS) - Generic
    5 votes
  96. Csrf in watch-unwatch projectsCross-Site Request Forgery (CSRF) · low
    5 votes
  97. session id missing secure flag - Hosted WebsiteImproper Authentication - Generic · low
    5 votes
  98. Open redirect while disconnecting authenticated accountOpen Redirect · medium
    5 votes
  99. Access to completion page without performing any actionImproper Access Control - Generic
    5 votes
  100. Spamming any user from Reset Password FunctionViolation of Secure Design Principles · low
    5 votes