Denial of service to WP-JSON API by cache poisoning the CORS allow origin header Analysed #591302 Valid Denial of Service Medium 2020-04-16 – 405 Sql injection on docs.atavist.com Analysed #1039315 Valid SQL Injection High 2020-12-08 – 170 SQL Injection intensedebate.com Analysed #1069561 Valid SQL Injection Medium 2021-01-11 – 102 DOM XSS on multiple Automattic domains through postMessages Analysed #2371019 Valid Cross-site Scripting High 2024-02-26 – 92 Reflected XSS in https://www.intensedebate.com/js/getCommentLink.php Analysed #1043804 Valid Cross-site Scripting Medium 2021-01-30 – 75 Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE] Analysed #1067547 Valid Information Disclosure High 2021-02-01 – 71 WordPress Flash XSS in *flashmediaelement.swf* Analysed #134546 Valid Cross-site Scripting – 2016-07-10 – 70 Broken Authentication - Security token gets captured via man in the middle attack Analysed #206650 Valid Authentication High 2019-06-22 – 67 Disclosure of 152 cookie names via crafted input Analysed #310105 Valid Information Disclosure Low 2019-08-04 – 65 Captcha bypass for the most important function - At en.instagram-brand.com Analysed #206653 Valid No weakness recorded Medium 2019-06-22 – 65 Authentication & Registration Bypass in Newspack Extended Access Analysed #2536758 Valid Authentication Medium 2024-07-05 – 58 XSS and HTML Injection on the pressable.com search box Analysed #1537149 Valid Cross-site Scripting Medium 2022-08-23 – 57 DOM-Based XSS in tumblr.com Analysed #949382 Valid Cross-site Scripting Medium 2021-02-02 – 56 Wordpress VIP leaks email of the test a/c Analysed #540301 Valid Information Disclosure Medium 2019-05-28 – 52 Open redirect via redirect_to parameter in tumblr.com Analysed #2812583 Valid Open Redirect Low 2024-11-05 – 51 Authentication & Registration Bypass in Newspack Extended Access Analysed #2472798 Valid Authentication Medium 2024-05-20 – 51 WordPress SOME bug in plupload.flash.swf leading to RCE Analysed #134738 Valid Command and Code Injection – 2016-07-10 – 50 Unauthenticated Private Messages DIsclosure via wordpress Rest API Analysed #1590237 Valid Information Disclosure Medium 2022-08-04 – 45 cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com ) Analysed #201796 Valid Misconfiguration and Insecure Design Medium 2017-02-02 – 39 No Rate Limit when accessing "Password protection" enabled surveys leads to bypassing passwords via "pd-pass_surveyid" cookie Analysed #905816 Valid Input Validation and Logic Low 2020-11-18 – 33 Unauthenticated RCE in Vaultpress Analysed #236552 Valid No weakness recorded Critical 2017-09-15 – 31 information disclosure lead to disclose users private notes Analysed #1070081 Valid Information Disclosure Low 2021-02-25 – 29 Insufficient DKIM record with RSA 512-bit key used on WordPress.com Analysed #550937 Valid Cryptography Medium 2019-05-30 – 27 Captcha checker "pd-captcha_form_SURVEYID" cookie is accepting any value Analysed #920357 Valid Access Control Medium 2020-11-18 – 26 Rate Limit Misconfiguration on tumblr login . Analysed #708917 Valid Authentication – 2020-11-13 – 21 [tumblr.com] CSRF in /svc/user/filtered_content Analysed #1010806 Valid Cross-Site Request Forgery Low 2020-12-26 – 20 Reflected XSS on a Atavist theme Analysed #947790 Valid Cross-site Scripting Medium 2020-11-18 – 20