HexBrain
Sign in

Browse / Weblate

Weblate

158disclosed reports

See its reports on the map

What gets reported to Weblate

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. **Unauthenticated IDOR allows modification of payment customer billing information**Insecure Direct Object Reference (IDOR) · high
    72 votes
  2. exposure of personal IP address via email.Privacy Violation
    61 votes
  3. SSRF via URL Parser Differential in `normalize_request_url` (wlc)Server-Side Request Forgery (SSRF) · high
    43 votes
  4. Reset password cookie leads to account takeoverReliance on Cookies without Validation and Integrity Checking in a Security Decision · medium
    41 votes
  5. Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command executionOS Command Injection · high
    34 votes
  6. Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on WeblateInformation Disclosure
    34 votes
  7. Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in WeblateUncontrolled Resource Consumption · high
    33 votes
  8. Billion laughs entity expansion in Qt .ts discovery: a crafted ~950 KB file forces ~55 MB of XML expansion per parse, cost scales with crafted file cXML Entity Expansion · medium
    29 votes
  9. CSRF with logout actionCross-Site Request Forgery (CSRF)
    29 votes
  10. no captcha for register user and weak question attacker can spam emailViolation of Secure Design Principles
    29 votes
  11. API token sent to URL dictated by an untrusted project .weblate fileInformation Disclosure · medium
    27 votes
  12. Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`Uncontrolled Resource Consumption · medium
    24 votes
  13. Open Github Repo Leaking WEBLATE SECRET KEYCleartext Storage of Sensitive Information
    22 votes
  14. Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.Path Traversal · medium
    21 votes
  15. Race Condition allows to get more free trials and get more than 100 languages and strings for freeBusiness Logic Errors · low
    20 votes
  16. HTML injection and information disclosure in support panelInformation Disclosure · medium
    20 votes
  17. Broken Authentication – Session Token bugImproper Authentication - Generic
    19 votes
  18. Uploaded XLF files result in External Entity ExecutionXML External Entities (XXE) · high
    18 votes
  19. Rate Limit Bypass on login PageImproper Authentication - Generic · medium
    18 votes
  20. Uncaught RecursionError crash in translation-finder (deep directory tree DoS)Uncontrolled Resource Consumption · low
    16 votes
  21. Insecure Account Removal #2Violation of Secure Design Principles · low
    16 votes
  22. wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.Information Exposure Through an Error Message · low
    14 votes
  23. CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matchingUncontrolled Resource Consumption · medium
    13 votes
  24. No rate limiting for Remove Account lead to huge Mass mailingsBusiness Logic Errors
    13 votes
  25. DKIM records not present, Email Hijacking is possible.....Improper Authentication - Generic
    12 votes
  26. Password RestrictionViolation of Secure Design Principles · low
    12 votes
  27. Translation discovery crashes on crafted filenames (regex substitution injection)Use of Externally-Controlled Format String · low
    11 votes
  28. Stored XSS via Create Project (Add new translation project)Cross-site Scripting (XSS) - Stored · medium
    11 votes
  29. No Rate On Add SuggestConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low
    11 votes
  30. flood of comment no rate limit on commnets >> by using different user agent Violation of Secure Design Principles · low
    11 votes
  31. no notification send to victim if attacker hacks/accesses his victims WebLate account.Business Logic Errors · low
    11 votes
  32. Login CSRF : Login Authentication FlawCross-Site Request Forgery (CSRF) · medium
    11 votes
  33. Account Takeover using Third party Auth CSRFCross-Site Request Forgery (CSRF) · high
    11 votes
  34. Logging in without knowing credentials after logged out actionImproper Authentication - Generic
    10 votes
  35. Rate Limit Issue on hosted.weblate.orgImproper Restriction of Authentication Attempts · low
    10 votes
  36. Weak password policyImproper Authentication - Generic · low
    10 votes
  37. Weak e-mail change functionality could lead to account takeoverViolation of Secure Design Principles · low
    10 votes
  38. No rate Limit on Add new Translation Project Improper Restriction of Authentication Attempts
    9 votes
  39. Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/registerViolation of Secure Design Principles
    9 votes
  40. Insecure Account RemovalViolation of Secure Design Principles · low
    9 votes
  41. Activation tokens are not expiringCross-Site Request Forgery (CSRF) · medium
    9 votes
  42. Testing flow includes a DeepSource secretUse of Hard-coded Credentials · low
    8 votes
  43. Missing Restriction On String SizeMemory Corruption - Generic
    8 votes
  44. Reset password more than once with a reset link #2Business Logic Errors
    8 votes
  45. Running 2 accounts with a single email #3Business Logic Errors
    8 votes
  46. Reset password more than once with a reset linkBusiness Logic Errors
    8 votes
  47. No Rate Limiting at /contactMemory Corruption - Generic · low
    8 votes
  48. No Password Length Restriction leads to Denial of ServiceUncontrolled Resource Consumption · low
    8 votes
  49. No BruteForce ProtectionImproper Restriction of Authentication Attempts · medium
    8 votes
  50. Registration captcha bypassViolation of Secure Design Principles · medium
    8 votes
  51. Stored XSS @ /engage/<project_slug>Cross-site Scripting (XSS) - Stored · medium
    7 votes
  52. Browser Self XSS Protection not implementedInformation Disclosure
    7 votes
  53. Password token validation in Weblate Bypass #2Improper Authentication - Generic
    7 votes
  54. Running 2 accounts with a single email [Part 2]Business Logic Errors
    7 votes
  55. Weblate |Security Misconfiguration| Method Enumeration Possible on domain Misconfiguration
    7 votes
  56. Takeover of an account via reset password options after removing the accountImproper Authentication - Generic · low
    7 votes
  57. Information Disclosure on demo.weblate.orgInformation Disclosure · low
    7 votes
  58. Captcha Bypass at Email Reset can lead to Spamming users.Violation of Secure Design Principles
    7 votes
  59. Design Flaw in session management of password reset Improper Access Control - Generic
    7 votes
  60. CSRF to Connect third party AccountCross-Site Request Forgery (CSRF) · medium
    7 votes
  61. Running 2 accounts with a single emailBusiness Logic Errors
    7 votes
  62. Missing restriction on string size of Full Name at https://demo.weblate.org/accounts/register/Memory Corruption - Generic · low
    7 votes
  63. CSV Injection with the CSV export featureOS Command Injection · low
    7 votes
  64. CSRF : Reset API Cross-Site Request Forgery (CSRF) · low
    7 votes
  65. Logout CSRFCross-Site Request Forgery (CSRF) · low
    7 votes
  66. 2nd issue>>> flood of email no rate limit on delete account confirmation email >> Violation of Secure Design Principles · low
    6 votes
  67. Application allowing old password to be set as new password | hosted.weblate.orgImproper Authentication - Generic
    6 votes
  68. Improper validation of unicode characters #3
    6 votes
  69. Persistence of Third Party Association.Business Logic Errors
    6 votes
  70. Full Name Overwrite on Third party loginImproper Authentication - Generic
    6 votes
  71. Old password can be new passwordImproper Authentication - Generic · low
    6 votes
  72. CSV export filter bypass leads to formula injection.Command Injection - Generic · medium
    6 votes
  73. No Rate Limitting at Change PasswordImproper Restriction of Authentication Attempts · medium
    6 votes
  74. [hosted.weblate.org]Account TakeoverImproper Authentication - Generic · low
    6 votes
  75. Login using disconnected google account i.e login using old email idImproper Authentication - Generic · low
    6 votes
  76. You can simply just use passwords that simply are as 123456Improper Authentication - Generic · low
    6 votes
  77. Send Empty CSRF leads to log out user on [https://hosted.weblate.org/accounts/profile]Cross-Site Request Forgery (CSRF) · low
    5 votes
  78. No Rate Limit On Add new wordBusiness Logic Errors · low
    5 votes
  79. Tab nabbing via window.opener
    5 votes
  80. Add another email address without verificationImproper Access Control - Generic
    5 votes
  81. Password token validation in Weblate BypassImproper Authentication - Generic
    5 votes
  82. No Rate Limitation on Regenerate Api KeyImproper Restriction of Authentication Attempts
    5 votes
  83. Improper validation of unicode characters still not fixed #2
    5 votes
  84. The username of an account can be ..Business Logic Errors
    5 votes
  85. Improper validation of unicode charactersViolation of Secure Design Principles
    5 votes
  86. Improper validation of unicode characters still not fixed
    5 votes
  87. Open redirect while disconnecting EmailOpen Redirect
    5 votes
  88. Improper Cookie expiration | Cookies Expiration Set to Future Misconfiguration · low
    5 votes
  89. Option method enabledViolation of Secure Design Principles
    5 votes
  90. Missing restriction on string sizelow
    5 votes
  91. Self-XSS can be achieved in the editor link using filter bypassCross-site Scripting (XSS) - Generic
    5 votes
  92. Csrf in watch-unwatch projectsCross-Site Request Forgery (CSRF) · low
    5 votes
  93. session id missing secure flag - Hosted WebsiteImproper Authentication - Generic · low
    5 votes
  94. Open redirect while disconnecting authenticated accountOpen Redirect · medium
    5 votes
  95. Access to completion page without performing any actionImproper Access Control - Generic
    5 votes
  96. Spamming any user from Reset Password FunctionViolation of Secure Design Principles · low
    5 votes
  97. Clickjacking docs.weblate.orgUI Redressing (Clickjacking) · low
    5 votes
  98. Web server is vulnerable to Beast AttackCryptographic Issues - Generic · low
    5 votes
  99. CSRF : Lock and Unlock TranslationCross-Site Request Forgery (CSRF) · medium
    5 votes
  100. Open Redirect via "next" parameter in third-party authenticationOpen Redirect · medium
    5 votes