🎯 New Report #3399809: Stored XSS on inventory-retrieve.php
🔺Severity: Low
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:33:09
📝 Summary: A Cross-site Scripting (XSS) vulnerability was discovered on the inventory-retrieve.php and campaign-edit.php pages. The vulnerability allowed an attacker to inject malicious code that would be executed when the page was loaded.
📂 Report JSON File: 3399809
@hackeronereports

🎯 New Report #3399218: Improper sanitisation of input in the settings could cause DoS
🔺Severity: Low
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:32:50
📝 Summary: A vulnerability was found in the settings functionality of the application where attacker-controlled values in the email fromName and email fromCompany fields were persisted and later rendered to pages without proper output encoding. This could have led to the execution of arbitrary JavaScript in the context of the application, potentially disrupting or replacing the page UI and effectively disabling the site for affected users.
📂 Report JSON File: 3399218
@hackeronereports

🎯 New Report #3399191: Reflected XSS in account-preferences-plugin.php
🔺Severity: Medium
👽 Reporter: lu3ky-13
⭐️ Reputation: 17159
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-25
⏰ Disclosed: 2025-11-19 09:32:33
📝 Summary: A reflected cross-site scripting (XSS) vulnerability was discovered in the account-preferences-plugin.php file of the Revive Adserver 6.0.1 application. Untrusted input from the "group" query parameter was reflected without proper output encoding or context-aware escaping, allowing the injection of malicious JavaScript code into the resulting page.
📂 Report JSON File: 3399191
@hackeronereports

🎯 New Report #3398283: Authorization bypass allows changing email address of other users
🔺Severity: High
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-10-24
⏰ Disclosed: 2025-11-19 09:32:13
📝 Summary: The Revive Adserver 6.0.0 was found to have an authorization bypass vulnerability that allowed changing the email address of other users without requiring the account password. The vulnerability was present in the admin panel endpoint /admin/agency-user.php, which accepted a POST request that updated a user's email without re-authentication.
📂 Report JSON File: 3398283
@hackeronereports

🎯 New Report #3413890: Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrieval
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-11-06
⏰ Disclosed: 2025-11-19 13:00:00
📝 Summary: null
📂 Report JSON File: 3413890
@hackeronereports

🎯 New Report #3413764: Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation)
🔺Severity: Medium
👽 Reporter: yoyomiski
⭐️ Reputation: 303
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-11-06
⏰ Disclosed: 2025-11-19 12:57:16
📝 Summary: null
📂 Report JSON File: 3413764
@hackeronereports

🎯 New Report #3411750: Stored-XSS in campaign name displayed in Banners modal
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-11-05
⏰ Disclosed: 2025-11-19 12:56:20
📝 Summary: null
📂 Report JSON File: 3411750
@hackeronereports

🎯 New Report #3328291: Existence of completed pods allows for bypass of Kubernetes NetworkPolicy
🔺Severity: Medium
👽 Reporter: savannabungee
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-09-05
⏰ Disclosed: 2025-11-19 23:05:18
📝 Summary: null
📂 Report JSON File: 3328291
@hackeronereports

🎯 New Report #3328343: Lack of minimum value bid wheel verification on customer bid in Rental Trips
🔺Severity: Low
👽 Reporter: sameer ali
⭐️ Reputation: 592
🛠 State: resolved
💼 Team: Bykea
💵 Bounty: null
🕐 Submitted: 2025-09-05
⏰ Disclosed: 2025-11-20 05:46:58
📝 Summary: A missing validation on the customer bid field when creating rental trips allowed passengers to submit arbitrary bid amounts, including very low fares. Proper validation was added to prevent unrealistic values.
📂 Report JSON File: 3328343
@hackeronereports

🎯 New Report #3295503: Customer can cancel a individual booking in a batch, causing locking of partner.
🔺Severity: Medium
👽 Reporter: sameer ali
⭐️ Reputation: 592
🛠 State: resolved
💼 Team: Bykea
💵 Bounty: null
🕐 Submitted: 2025-08-12
⏰ Disclosed: 2025-11-20 05:32:17
📝 Summary: The vulnerability allowed users to update the status of individual trips inside a batch, even though only batch-level status changes were intended. By cancelling the single trip inside a one-parcel batch, the batch was placed into an inconsistent state, causing the assigned partner to become stuck in a booking they could not complete or cancel.
📂 Report JSON File: 3295503
@hackeronereports

🎯 New Report #3328367: Path traversal via archive.extract - CVE 2021-3281 incomplete patch
🔺Severity: Low
👽 Reporter: stackered
⭐️ Reputation: 198
🛠 State: resolved
💼 Team: Django
💵 Bounty: null
🕐 Submitted: 2025-09-05
⏰ Disclosed: 2025-11-21 19:05:24
📝 Summary: A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect against partial-path traversal. As a result, an attacker could potentially write files outside of the base directory when unzipping archives.
📂 Report JSON File: 3328367
@hackeronereports

🎯 New Report #3329310: Improper bot-authentication allows to impersonate any user when sending messages in a room
🔺Severity: High
👽 Reporter: stackered
⭐️ Reputation: 198
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 2000
🕐 Submitted: 2025-09-06
⏰ Disclosed: 2025-11-21 19:39:42
📝 Summary: A vulnerability was discovered in the bot authentication mechanism. The issue allowed an unauthenticated user to impersonate any user and post messages in rooms the impersonated user had access to. The bot authentication function failed to properly validate the bot key, allowing a partial key to match a valid user record.
📂 Report JSON File: 3329310
@hackeronereports

🎯 New Report #3434543: Arbitrary free in curl's config file parsing.
🔺Severity: Low
👽 Reporter: letshack9707
⭐️ Reputation: 100
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-20
⏰ Disclosed: 2025-11-23 16:03:02
📝 Summary: null
📂 Report JSON File: 3434543
@hackeronereports

🎯 New Report #3426761: HTML Injection in Emails on login.mtb.com via givenName parameter leads to phishing attacks
🔺Severity: Medium
👽 Reporter: ozgun32
⭐️ Reputation: 207
🛠 State: resolved
💼 Team: M T Bank Vulnerability Disclosure
💵 Bounty: null
🕐 Submitted: 2025-11-15
⏰ Disclosed: 2025-11-24 14:07:16
📝 Summary: A vulnerability was found that allowed HTML injection in emails on login.mtb.com via the givenName parameter. This vulnerability could have enabled phishing attacks.
📂 Report JSON File: 3426761
@hackeronereports

🎯 New Report #3432833: [SFTP TOCTOU Race Condition in Upload Resume Logic Leads to Arbitrary File Append](https://hackerone.com/reports/3432833)
🔺Severity: Medium
👽 Reporter: cainvsilf
⭐️ Reputation: 100
🛠 State: informative
💼 Team: curl
💵 Bounty: null
🕐 Submitted: 2025-11-19
⏰ Disclosed: 2025-11-24 18:55:10
📝 Summary: null
📂 Report JSON File: 3432833
@hackeronereports

🎯 New Report #1916400: High resource consumption by insufficient sanitization of forum threads pagination
🔺Severity: Medium
👽 Reporter: maskopatol
⭐️ Reputation: 3795
🛠 State: resolved
💼 Team: Flickr
💵 Bounty: 479
🕐 Submitted: 2023-03-24
⏰ Disclosed: 2025-11-24 22:33:46
📝 Summary: The forum threads pagination functionality was insufficiently sanitized, leading to high resource consumption. When a page number was provided in the URL that exceeded the number of available pages, an infinite loop was triggered, generating excessive markup on each iteration. The issue was resolved by correcting the logic to avoid generating links to non-existent pages.
📂 Report JSON File: 1916400
@hackeronereports

🎯 New Report #3434156: Username Validation Bypass
🔺Severity: Medium
👽 Reporter: kassem s94
⭐️ Reputation: 10331
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2025-11-19
⏰ Disclosed: 2025-11-26 14:18:23
📝 Summary: null
📂 Report JSON File: 3434156
@hackeronereports

🎯 New Report #2932960: [my.stripo.email Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier](https://hackerone.com/reports/2932960)
🔺Severity: Critical
👽 Reporter: odaysec
⭐️ Reputation: null
🛠 State: resolved
💼 Team: Stripo Inc
💵 Bounty: null
🕐 Submitted: 2025-01-13
⏰ Disclosed: 2025-12-01 08:22:34
📝 Summary: A critical Blind SSRF (Server-Side Request Forgery) vulnerability was identified in the export service of the Stripo app. The vulnerability existed in the endpoint /exportservice/v3/exports/WEBHOOK/accounts, where malicious input could be provided in the webhookUrl parameter, triggering SSRF and allowing the server to make unauthorized HTTP requests to attacker-controlled systems.
📂 Report JSON File: 2932960
@hackeronereports

🎯 New Report #3417967: Potential SQL Injection when annotating FilteredRelation on PostgreSQL
🔺Severity: High
👽 Reporter: stackered
⭐️ Reputation: 212
🛠 State: resolved
💼 Team: Django
💵 Bounty: null
🕐 Submitted: 2025-11-09
⏰ Disclosed: 2025-12-02 15:28:06
📝 Summary: A potential SQL injection vulnerability was discovered in Django's annotation of FilteredRelation on PostgreSQL. The vulnerability was caused by an incomplete regular expression filter in the FORBIDDEN ALIAS PATTERN. This allowed user input to be interpreted as raw strings, potentially enabling the execution of malicious SQL queries. The vulnerability was reported to the Django security team.
📂 Report JSON File: 3417967
@hackeronereports

🎯 New Report #2890071: admin audit does not log actions on files in a group folder
🔺Severity: Medium
👽 Reporter: klipz
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2024-12-09
⏰ Disclosed: 2025-12-05 08:22:06
📝 Summary: The admin audit app in Nextcloud versions prior to 24.0.4 did not log actions on files in a group folder.
📂 Report JSON File: 2890071
@hackeronereports

🎯 New Report #3247499: Deck app allowed user with "Can share" permission to modify permissions of other non-owners
🔺Severity: Medium
👽 Reporter: daroo
⭐️ Reputation: 460
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 250
🕐 Submitted: 2025-07-11
⏰ Disclosed: 2025-12-05 08:20:21
📝 Summary: The Deck app in Nextcloud allowed users with "Can share" permission to modify the permissions of other non-owners.
📂 Report JSON File: 3247499
@hackeronereports