CORS on my.stripo.email #859688 Informative No weakness recorded – 2020-04-28 – 1 Strored Xss on https://my.stripo.email/ ( multiple inputs) #789418 Valid Cross-site Scripting – 2020-03-25 – 2 Able to download any hosted content on AWS S3 bucket(stripo) #739858 Valid Access Control – 2020-02-10 – 3 Stored XSS in template comments. #759131 Valid Cross-site Scripting – 2020-01-31 – 3 SSRF leads to internal port scan #764517 Valid Server-Side Request Forgery – 2020-03-24 – 3 my.stripo.emai email verification bypassed and also create email templates #765318 Valid Input Validation and Logic – 2020-02-04 – 3 XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique #799867 Valid Cross-Site Request Forgery – 2020-03-25 – 4 Tabnabbing in template comments - stripo.email #759133 Valid Misconfiguration and Insecure Design – 2020-01-31 – 5 Email verification bypasa #763458 Valid Access Control – 2020-03-24 – 5 SSL cookie without secure flag set #738565 Duplicate No weakness recorded – 2020-10-13 – 6 SSRF via Export Service in ActiveCampaign #847101 Valid Server-Side Request Forgery – 2020-07-13 – 6 SSRF in my.stripo.email #852413 Valid Server-Side Request Forgery – 2020-06-30 – 6 [www.stripo.email] There is no rate limit for /it/contact-us/ endpoints #856310 Duplicate Authentication – 2020-07-03 – 6 Integer Overflow (CVE_2017_7529) #876257 Valid Memory Corruption – 2020-07-13 – 6 Stored XSS at Template Editor in "Section Name" Field of Block element 'Accordion'. #1025365 Valid Cross-site Scripting – 2020-12-24 – 6 Clickjacking on my.stripo.email for MailChimp credentials #737625 Informative Misconfiguration and Insecure Design – 2020-01-08 – 7 Information disclosure through Server side resource forgery #782979 Informative Server-Side Request Forgery – 2020-01-28 – 7 Blind SSRF while Creating Templates #800909 Valid Server-Side Request Forgery – 2020-03-24 – 7 multiple email usage -my.stripo.email- #887167 Valid Access Control – 2020-07-03 – 7 Race condition on my.stripo.email at /cabinet/stripeapi/v1/projects/298427/emails/folders uri #994051 Valid Race Conditions – 2020-11-09 – 7 No rate limiting - Create Plug-ins #1047119 Valid Input Validation and Logic – 2021-01-05 – 7 Insecure Storage and Overly Permissive API Keys #1283575 Valid Cryptography – 2022-03-30 – 7 Authorization for wp-admin directory are vulnerable to brute force. #788420 Valid Authentication – 2020-02-05 – 8 [www.stripo.email] You can bypass the speed limit by changing the IP. #881186 Valid Information Disclosure – 2020-06-30 – 8 Unrestricted File Upload on https://my.stripo.email and https://stripo.email #823588 Valid File and Path Handling – 2020-04-13 – 9 No rate limiting for confirmation email lead to huge Mass mailings #1055503 Informative Input Validation and Logic – 2020-12-11 – 9 SSRF in /cabinet/stripeapi/v1/siteInfoLookup?url=XXX #738553 Valid Server-Side Request Forgery – 2019-12-18 – 11 Permanent DOS for new users! #1057484 Informative Denial of Service – 2020-12-21 – 11 Redirection through referer tag #737578 Valid No weakness recorded – 2019-12-18 – 12 No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address #753386 Valid Cross-Site Request Forgery – 2020-09-08 – 12 stripo blog search SQL Injection #761382 Valid SQL Injection – 2020-01-30 – 12 SSRF in Export template to ActiveCampaign #754025 Valid Server-Side Request Forgery – 2020-04-10 – 13 CSRF - Modify Project Settings #766533 Valid Cross-Site Request Forgery – 2020-02-03 – 13 Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKEN #915541 Valid Access Control – 2020-07-27 – 13 Stored XSS at "Conditions " through "My Custom Rule" Field at [https://my.stripo.email/cabinet/#/template-editor/] in Template Editor. #996371 Valid Cross-site Scripting – 2020-12-24 – 13 Non-revoked API Key Information disclosure via Stripo_report() #1613714 Valid Cryptography – 2022-08-25 – 13 Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo #1709815 Valid Cryptography – 2024-02-15 – 13 No Rate Limiting on /reset-password-request/ endpoint #764122 Valid Misconfiguration and Insecure Design – 2020-02-04 – 14 OLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGE #737039 Valid No weakness recorded – 2019-12-19 – 15 csrf bypass using flash file + 307 redirect method at plugins endpoint #766205 Valid Cross-Site Request Forgery – 2020-02-10 – 15 HTTP Request Smuggling on my.stripo.email #777651 Valid No weakness recorded – 2020-04-10 – 15 Ability to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referral #1166993 Valid Input Validation and Logic – 2022-03-30 – 15 subdomain takeover at status-stage0.stripo.email #781614 Valid Access Control – 2020-01-30 – 16 No rate limit in email subscription #1047124 Valid Input Validation and Logic – 2021-01-11 – 16 Bypass email verification and create email template with the editor #737169 Valid No weakness recorded – 2019-12-19 – 18 No rate limiting - Create data #1047100 Valid Input Validation and Logic – 2021-01-05 – 18 [demo.stripo.email] HTTP request Smuggling #1631228 Valid Injection and Smuggling – 2024-02-15 – 18 Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo #1047125 Valid Cryptography – 2020-12-04 – 19 Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/ #1076047 Valid Input Validation and Logic – 2021-01-13 – 19 Password token leak via Host header #737042 Valid Misconfiguration and Insecure Design – 2019-12-19 – 20