Strored Xss on https://my.stripo.email/ ( multiple inputs) #789418 Valid Cross-site Scripting Medium 2020-03-25 – 2 Able to download any hosted content on AWS S3 bucket(stripo) #739858 Valid Access Control Low 2020-02-10 – 3 Stored XSS in template comments. #759131 Valid Cross-site Scripting Medium 2020-01-31 – 3 SSRF leads to internal port scan #764517 Valid Server-Side Request Forgery Low 2020-03-24 – 3 my.stripo.emai email verification bypassed and also create email templates #765318 Valid Input Validation and Logic Medium 2020-02-04 – 3 XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique #799867 Valid Cross-Site Request Forgery Medium 2020-03-25 – 4 Tabnabbing in template comments - stripo.email #759133 Valid Misconfiguration and Insecure Design Low 2020-01-31 – 5 Email verification bypasa #763458 Valid Access Control High 2020-03-24 – 5 SSRF via Export Service in ActiveCampaign #847101 Valid Server-Side Request Forgery High 2020-07-13 – 6 SSRF in my.stripo.email #852413 Valid Server-Side Request Forgery High 2020-06-30 – 6 Integer Overflow (CVE_2017_7529) #876257 Valid Memory Corruption Medium 2020-07-13 – 6 Stored XSS at Template Editor in "Section Name" Field of Block element 'Accordion'. #1025365 Valid Cross-site Scripting Medium 2020-12-24 – 6 Blind SSRF while Creating Templates #800909 Valid Server-Side Request Forgery High 2020-03-24 – 7 multiple email usage -my.stripo.email- #887167 Valid Access Control Medium 2020-07-03 – 7 Race condition on my.stripo.email at /cabinet/stripeapi/v1/projects/298427/emails/folders uri #994051 Valid Race Conditions Medium 2020-11-09 – 7 No rate limiting - Create Plug-ins #1047119 Valid Input Validation and Logic Medium 2021-01-05 – 7 Insecure Storage and Overly Permissive API Keys #1283575 Valid Cryptography Medium 2022-03-30 – 7 Authorization for wp-admin directory are vulnerable to brute force. #788420 Valid Authentication High 2020-02-05 – 8 [www.stripo.email] You can bypass the speed limit by changing the IP. #881186 Valid Information Disclosure Medium 2020-06-30 – 8 Unrestricted File Upload on https://my.stripo.email and https://stripo.email #823588 Valid File and Path Handling Medium 2020-04-13 – 9 SSRF in /cabinet/stripeapi/v1/siteInfoLookup?url=XXX #738553 Valid Server-Side Request Forgery Medium 2019-12-18 – 11 Redirection through referer tag #737578 Valid No weakness recorded Low 2019-12-18 – 12 No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address #753386 Valid Cross-Site Request Forgery Medium 2020-09-08 – 12 stripo blog search SQL Injection #761382 Valid SQL Injection Medium 2020-01-30 – 12 SSRF in Export template to ActiveCampaign #754025 Valid Server-Side Request Forgery Medium 2020-04-10 – 13 CSRF - Modify Project Settings #766533 Valid Cross-Site Request Forgery Critical 2020-02-03 – 13 Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKEN #915541 Valid Access Control High 2020-07-27 – 13 Stored XSS at "Conditions " through "My Custom Rule" Field at [https://my.stripo.email/cabinet/#/template-editor/] in Template Editor. #996371 Valid Cross-site Scripting Medium 2020-12-24 – 13 Non-revoked API Key Information disclosure via Stripo_report() #1613714 Valid Cryptography Medium 2022-08-25 – 13 Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo #1709815 Valid Cryptography Medium 2024-02-15 – 13 No Rate Limiting on /reset-password-request/ endpoint #764122 Valid Misconfiguration and Insecure Design Medium 2020-02-04 – 14 OLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGE #737039 Valid No weakness recorded Medium 2019-12-19 – 15 csrf bypass using flash file + 307 redirect method at plugins endpoint #766205 Valid Cross-Site Request Forgery Medium 2020-02-10 – 15 HTTP Request Smuggling on my.stripo.email #777651 Valid No weakness recorded High 2020-04-10 – 15 Ability to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referral #1166993 Valid Input Validation and Logic High 2022-03-30 – 15 subdomain takeover at status-stage0.stripo.email #781614 Valid Access Control Medium 2020-01-30 – 16 No rate limit in email subscription #1047124 Valid Input Validation and Logic Medium 2021-01-11 – 16 Bypass email verification and create email template with the editor #737169 Valid No weakness recorded High 2019-12-19 – 18 No rate limiting - Create data #1047100 Valid Input Validation and Logic Medium 2021-01-05 – 18 [demo.stripo.email] HTTP request Smuggling #1631228 Valid Injection and Smuggling Medium 2024-02-15 – 18 Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo #1047125 Valid Cryptography Medium 2020-12-04 – 19 Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/ #1076047 Valid Input Validation and Logic Medium 2021-01-13 – 19 Password token leak via Host header #737042 Valid Misconfiguration and Insecure Design Medium 2019-12-19 – 20 Improper Authorization #751299 Valid Access Control High 2020-02-03 – 20 SSRF external interaction #1023920 Valid Server-Side Request Forgery Low 2020-12-11 – 21 weak password poilicy in signup password leak to account takeover #985367 Valid Misconfiguration and Insecure Design None 2020-10-16 – 23 Stored XSS at Module Name #1126433 Valid Cross-site Scripting Medium 2021-04-12 – 23 SSRF & unrestricted file upload on https://my.stripo.email/ #771382 Valid Server-Side Request Forgery Critical 2020-02-19 – 24 Stored XSS in the banner block description Analysed #1065964 Valid Cross-site Scripting Medium 2021-03-09 – 25 Memory Dump and Env Disclosure via Spring Boot Actuator Analysed #1019367 Valid Misconfiguration and Insecure Design Medium 2021-03-02 – 27