Google dork lead to unsubscribe anyone from all Banfield emails #2055081 Valid Access Control – 2023-08-30 – 12 Jolokia Reflected XSS #1714563 Valid Cross-site Scripting – 2022-10-27 – 13 Information Exposure Through Directory Listing #1948562 Valid Information Disclosure – 2023-06-23 – 13 CRLF Inection at `██████████` #1943013 Valid Injection and Smuggling – 2023-06-23 – 14 Stored XSS via ' profile ' at ███ #1921606 Valid Cross-site Scripting – 2023-06-23 – 16 ' Full Account Takeover ' at █████ #1959540 Valid Access Control – 2023-06-23 – 19 ███████ ' can delete any animal from other account ' at ██████████ #1947376 Valid Insecure Direct Object Reference – 2023-06-23 – 21 Information Exposure due to enabled debug mode #2243003 Valid No weakness recorded Low 2024-11-25 – 22 CSRF to delete a pet #2029753 Valid Cross-Site Request Forgery – 2023-08-30 – 25 Reflected XSS on formaction parameter #2089895 Valid Cross-site Scripting Medium 2024-11-19 – 25 **"CSRF Vulnerability in ███████ Website Allows Attackers to Change User Profile Picture at ███████"** #2144870 Valid No weakness recorded – 2023-11-15 – 26 ████ ' can add animal to other account ' at ██████ #1965640 Valid Insecure Direct Object Reference – 2023-06-22 – 27 sensitive data-creds for database - private key #2396630 Valid Cryptography Medium 2024-11-19 – 27 Customer Data Exposure via Insecure Endpoint of coupon #2828720 Valid Information Disclosure Medium 2025-05-27 – 28 No Rate Limiting on Password Attempts After Insecure Registration Flow cause ATO #3174778 Valid Authentication Medium 2026-02-24 – 28 No CSRF protection when adding an item to cart #2190062 Valid Cross-Site Request Forgery – 2024-01-30 – 29 Blind SQL Injection on █████ via URI Path #2266081 Valid SQL Injection – 2024-02-14 – 29 CSRF resulting in adding pet at ███████ #2313478 Valid Cross-Site Request Forgery Low 2024-06-25 – 29 ███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration #3066548 Valid Information Disclosure Medium 2026-02-24 – 29 CVE-2022-21371: Oracle WebLogic Server Local File Inclusion #2387600 Valid No weakness recorded – 2024-03-04 – 30 ████ ' can change any account email and cannot retrieve his account and access it ' at ███ #1952771 Valid Insecure Direct Object Reference – 2023-06-23 – 32 CSRF in Delete Pet Function #2445106 Valid Cross-Site Request Forgery Medium 2024-11-19 – 32 Order More Than Maximum Allowed Quantity #3185001 Valid Input Validation and Logic – 2025-09-02 – 32 Sensitive Information Exposed at █████ #2308654 Valid Information Disclosure – 2024-01-30 – 33 Reflected xss on ████████ #2389897 Valid Cross-site Scripting Medium 2024-06-25 – 33 Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint #3376598 Valid Cryptography Medium 2026-02-24 – 35 phpinfo() exposed on ██████████ #2666151 Valid Misconfiguration and Insecure Design – 2024-11-21 – 36 massive PII leakage for ███████ #2887506 Valid Information Disclosure Medium 2025-05-12 – 36 RXSS in ███ via S parameter #2307913 Valid Cross-site Scripting Medium 2024-11-19 – 38 debug.log File Exposure that exposes (user/████) username and password at █████████ #2122938 Valid Cryptography – 2023-11-15 – 39 RXSS on ████ via q parameter #2166843 Valid Cross-site Scripting Low 2024-11-21 – 39 Client Side Template Injection to Stored XSS in Image Collection #2234564 Valid Cross-site Scripting – 2024-02-14 – 39 subdomain takeover at █████████ #2106886 Valid Misconfiguration and Insecure Design – 2023-11-15 – 40 RXSS on stores on *█████████/visitorRegistration.pml via destination parameter #2189797 Valid Cross-site Scripting Medium 2025-09-02 – 40 Users Data Exposure via Insecure Endpoint #2828608 Valid Information Disclosure Medium 2025-05-12 – 40 debug.log leaked [█████████] #3063026 Valid Information Disclosure Low 2025-05-12 – 40 Account takeover using reset password link #2341038 Valid Open Redirect Medium 2024-06-25 – 41 SQLi at █████ parameter #3277276 Valid SQL Injection Critical 2026-02-24 – 42 IDOR in one subdomain of █████████ -> change information of pets without athorization! #2073950 Valid Insecure Direct Object Reference – 2024-02-14 – 45 IDOR to account takeover on POST to █████████ by changing member_id parameter #2132183 Valid Insecure Direct Object Reference – 2024-01-30 – 45 unsubscribe anyone from all ████████ emails @ █████ #2354888 Valid Access Control Low 2024-11-25 – 45 Datadog api keys exposed can be used to do all the read and write access to the instance #2307933 Valid Information Disclosure – 2024-01-25 – 47 Sqli on ██████ search functionality #2453475 Valid SQL Injection Medium 2024-06-25 – 47 Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses #3360293 Valid Information Disclosure Medium 2026-02-24 – 49 Bug Report #23JAN135 (subdomain takeover via shopify ) #1851886 Valid Access Control High 2025-09-02 – 50 phpinfo() exposed on ██████████ #2641211 Valid Misconfiguration and Insecure Design Medium 2024-11-21 – 51 Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████ #2262554 Valid Authentication – 2024-01-30 – 53 RXSS on ████ via configUrl parameter #2684274 Valid Cross-site Scripting Low 2024-11-26 – 53 change part of personal information all users #2828693 Valid Access Control Critical 2025-05-12 – 53 unauthorized access and add user and change personal information all users #2828641 Valid Access Control Critical 2025-05-27 – 54