🎯 New Report #3404968: Stored-XSS in Banner Name field
🔺Severity: Low
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-30
⏰ Disclosed: 2025-11-19 09:36:35
📝 Summary: null
📂 Report JSON File: 3404968
@hackeronereports

🎯 New Report #3403727: Reflected XSS in /admin/banner-zone.php (v6.0.0 )
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-29
⏰ Disclosed: 2025-11-19 09:36:08
📝 Summary: null
📂 Report JSON File: 3403727
@hackeronereports

🎯 New Report #3403450: Information Disclosure via Verbose Error Messages
🔺Severity: Medium
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-29
⏰ Disclosed: 2025-11-19 09:35:34
📝 Summary: null
📂 Report JSON File: 3403450
@hackeronereports

🎯 New Report #3401612: IDOR Vulnerability in Banner Deletion
🔺Severity: High
👽 Reporter: cyberjoker
⭐️ Reputation: 142
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-27
⏰ Disclosed: 2025-11-19 09:35:06
📝 Summary: null
📂 Report JSON File: 3401612
@hackeronereports

🎯 New Report #3401464: Information Disclosure via “Add user” lookup in Account Management (User Access)
🔺Severity: Medium
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-27
⏰ Disclosed: 2025-11-19 09:34:36
📝 Summary: null
📂 Report JSON File: 3401464
@hackeronereports

🎯 New Report #3400506: Stored XSS in Conversion Statistics via Tracker Name
🔺Severity: High
👽 Reporter: cyberjoker
⭐️ Reputation: 142
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-26
⏰ Disclosed: 2025-11-19 09:33:37
📝 Summary: null
📂 Report JSON File: 3400506
@hackeronereports

🎯 New Report #3399809: Stored XSS on inventory-retrieve.php
🔺Severity: Low
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:33:09
📝 Summary: A Cross-site Scripting (XSS) vulnerability was discovered on the inventory-retrieve.php and campaign-edit.php pages. The vulnerability allowed an attacker to inject malicious code that would be executed when the page was loaded.
📂 Report JSON File: 3399809
@hackeronereports

🎯 New Report #3399218: Improper sanitisation of input in the settings could cause DoS
🔺Severity: Low
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:32:50
📝 Summary: A vulnerability was found in the settings functionality of the application where attacker-controlled values in the email fromName and email fromCompany fields were persisted and later rendered to pages without proper output encoding. This could have led to the execution of arbitrary JavaScript in the context of the application, potentially disrupting or replacing the page UI and effectively disabling the site for affected users.
📂 Report JSON File: 3399218
@hackeronereports

🎯 New Report #3399191: Reflected XSS in account-preferences-plugin.php
🔺Severity: Medium
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:32:33
📝 Summary: A reflected cross-site scripting (XSS) vulnerability was discovered in the account-preferences-plugin.php file of the Revive Adserver 6.0.1 application. Untrusted input from the "group" query parameter was reflected without proper output encoding or context-aware escaping, allowing the injection of malicious JavaScript code into the resulting page.
📂 Report JSON File: 3399191
@hackeronereports

🎯 New Report #3398283: Authorization bypass allows changing email address of other users
🔺Severity: High
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-24
⏰ Disclosed: 2025-11-19 09:32:13
📝 Summary: The Revive Adserver 6.0.0 was found to have an authorization bypass vulnerability that allowed changing the email address of other users without requiring the account password. The vulnerability was present in the admin panel endpoint /admin/agency-user.php, which accepted a POST request that updated a user's email without re-authentication.
📂 Report JSON File: 3398283
@hackeronereports

🎯 New Report #3413890: Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrieval
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-11-06
⏰ Disclosed: 2025-11-19 13:00:00
📝 Summary: null
📂 Report JSON File: 3413890
@hackeronereports

🎯 New Report #3413764: Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation)
🔺Severity: Medium
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-11-06
⏰ Disclosed: 2025-11-19 12:57:16
📝 Summary: null
📂 Report JSON File: 3413764
@hackeronereports

🎯 New Report #3411750: Stored-XSS in campaign name displayed in Banners modal
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-11-05
⏰ Disclosed: 2025-11-19 12:56:20
📝 Summary: null
📂 Report JSON File: 3411750
@hackeronereports

🎯 New Report #3328291: Existence of completed pods allows for bypass of Kubernetes NetworkPolicy
🔺Severity: Medium
👽 Reporter: savannabungee
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-09-05
⏰ Disclosed: 2025-11-19 23:05:18
📝 Summary: null
📂 Report JSON File: 3328291
@hackeronereports

🎯 New Report #3328343: Lack of minimum value bid wheel verification on customer bid in Rental Trips
🔺Severity: Low
👽 Reporter: sameer ali
⭐️ Reputation: 592
🛠 State: resolved
💼 Team: Bykea
💵 Bounty: null
🕐 Submitted: 2025-09-05
⏰ Disclosed: 2025-11-20 05:46:58
📝 Summary: A missing validation on the customer bid field when creating rental trips allowed passengers to submit arbitrary bid amounts, including very low fares. Proper validation was added to prevent unrealistic values.
📂 Report JSON File: 3328343
@hackeronereports

🎯 New Report #3295503: Customer can cancel a individual booking in a batch, causing locking of partner.
🔺Severity: Medium
👽 Reporter: sameer ali
⭐️ Reputation: 592
🛠 State: resolved
💼 Team: Bykea
💵 Bounty: null
🕐 Submitted: 2025-08-12
⏰ Disclosed: 2025-11-20 05:32:17
📝 Summary: The vulnerability allowed users to update the status of individual trips inside a batch, even though only batch-level status changes were intended. By cancelling the single trip inside a one-parcel batch, the batch was placed into an inconsistent state, causing the assigned partner to become stuck in a booking they could not complete or cancel.
📂 Report JSON File: 3295503
@hackeronereports

🎯 New Report #3328367: Path traversal via archive.extract - CVE 2021-3281 incomplete patch
🔺Severity: Low
👽 Reporter: stackered
⭐️ Reputation: 198
🛠 State: resolved
💼 Team: Django
💵 Bounty: null
🕐 Submitted: 2025-09-05
⏰ Disclosed: 2025-11-21 19:05:24
📝 Summary: A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect against partial-path traversal. As a result, an attacker could potentially write files outside of the base directory when unzipping archives.
📂 Report JSON File: 3328367
@hackeronereports

🎯 New Report #3329310: Improper bot-authentication allows to impersonate any user when sending messages in a room
🔺Severity: High
👽 Reporter: stackered
⭐️ Reputation: 198
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 2000
🕐 Submitted: 2025-09-06
⏰ Disclosed: 2025-11-21 19:39:42
📝 Summary: A vulnerability was discovered in the bot authentication mechanism. The issue allowed an unauthenticated user to impersonate any user and post messages in rooms the impersonated user had access to. The bot authentication function failed to properly validate the bot key, allowing a partial key to match a valid user record.
📂 Report JSON File: 3329310
@hackeronereports

🎯 New Report #3434543: Arbitrary free in curl's config file parsing.
🔺Severity: Low
👽 Reporter: letshack9707
⭐️ Reputation: 100
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-20
⏰ Disclosed: 2025-11-23 16:03:02
📝 Summary: null
📂 Report JSON File: 3434543
@hackeronereports

🎯 New Report #3426761: HTML Injection in Emails on login.mtb.com via givenName parameter leads to phishing attacks
🔺Severity: Medium
👽 Reporter: ozgun32
⭐️ Reputation: 207
🛠 State: resolved
💼 Team: M T Bank Vulnerability Disclosure
💵 Bounty: null
🕐 Submitted: 2025-11-15
⏰ Disclosed: 2025-11-24 14:07:16
📝 Summary: A vulnerability was found that allowed HTML injection in emails on login.mtb.com via the givenName parameter. This vulnerability could have enabled phishing attacks.
📂 Report JSON File: 3426761
@hackeronereports

🎯 New Report #3432833: [SFTP TOCTOU Race Condition in Upload Resume Logic Leads to Arbitrary File Append](https://hackerone.com/reports/3432833)
🔺Severity: Medium
👽 Reporter: cainvsilf
⭐️ Reputation: 100
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-19
⏰ Disclosed: 2025-11-24 18:55:10
📝 Summary: null
📂 Report JSON File: 3432833
@hackeronereports