Bypassing CORS Misconfiguration Leads to Sensitive Exposure Analysed #768151 Valid Input Validation and Logic Medium 2020-05-14 – 145 Public instance of Jenkins on https://██████████/ with /script enabled Analysed #768266 Valid Command and Code Injection Critical 2020-01-31 – 118 Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/ Analysed #2083771 Valid Command and Code Injection Critical 2024-12-18 – 114 Wordpress Takeover using setup configuration at http://████.edu [HtUS] Analysed #1626205 Valid Misconfiguration and Insecure Design Critical 2023-01-13 $1,000 102 Public google drive link Exposes Military Orders Containing PII (Name, SSN etc..) and Operational Details Analysed #2926447 Valid Information Disclosure Critical 2025-01-24 – 99 Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeover Analysed #2748003 Valid Information Disclosure Critical 2024-10-25 – 98 [███████] Information disclosure due unauthenticated access to APIs and system browser functions Analysed #2122964 Valid Information Disclosure Medium 2023-11-03 – 97 XXE in DoD website that may lead to RCE Analysed #227880 Valid Injection and Smuggling Critical 2019-10-04 – 97 Time based SQL injection at████████ Analysed #2312334 Valid SQL Injection High 2024-01-26 – 96 LOGJ4 VUlnerability [HtUS] Analysed #1624137 Valid Command and Code Injection Critical 2022-11-18 $1,000 94 User automatically logged in as Sys Admin user on https://███/Administration/Administration.aspx Analysed #2190808 Valid Access Control Critical 2023-11-03 – 88 [SQLI ]Time Bassed Injection at ██████████ via referer header Analysed #995122 Valid SQL Injection High 2020-10-16 – 87 Remote Code Execution (RCE) in a DoD website Analysed #248116 Valid Command and Code Injection Critical 2019-10-04 – 84 Publicly Editable U.S. Air Force Google Spreadsheet Exposing Student Leave Data Analysed #2682079 Valid Access Control Medium 2025-02-12 – 83 Blind Sql Injection in https://████ Analysed #2597543 Valid SQL Injection Medium 2024-08-29 – 81 SQL Injection on www.██████████ on countID parameter Analysed #390879 Valid SQL Injection High 2019-10-08 – 80 Improper Authentication Allows Making Appeals as Other Users Analysed #2666323 Valid Authentication Medium 2025-02-12 – 77 IDOR leading unauthenticated attacker to download documents discloses PII of users and soldiers via https://www.█████████/Download.aspx?id= [HtUS] Analysed #1626508 Valid Insecure Direct Object Reference High 2024-06-27 $500 77 SQL Injection in ████ Analysed #419017 Valid SQL Injection High 2019-08-19 – 73 Full account takeover of any user through reset password Analysed #2194928 Valid Authentication Medium 2023-11-17 – 71 CVE-2020-3187 - Unauthenticated Arbitrary File Deletion Analysed #960330 Valid File and Path Handling Critical 2020-09-21 – 70 Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/` Analysed #2778380 Valid File and Path Handling High 2024-10-25 – 69 RCE on █████ via CVE-2017-10271 Analysed #576887 Valid Command and Code Injection Critical 2019-07-01 – 68 Boolen Based Blind Sql Injection Via User Agent in ███.mil Analysed #2599826 Valid SQL Injection Medium 2025-01-24 – 67 Improper Authentication (Login without Registration with any user) at ████ Analysed #2334420 Valid Authentication High 2024-03-22 – 67 [█████████] Administrative access to Oracle WebLogic Server using default credentials Analysed #804548 Valid Access Control Critical 2020-06-25 – 65 Subdomain takeover ████████.mil Analysed #2499178 Valid Access Control Critical 2024-06-27 – 64 CVE-2020-7961 RCE Liferay Portal Unauthenticated via https://████████/ Analysed #2742457 Valid Command and Code Injection Critical 2024-10-25 – 62 Unauthenticated SQL Injection at █████████ [HtUS] Analysed #1626226 Valid SQL Injection Critical 2022-10-14 – 61 Authentication Bypass on https://███████/ Analysed #2414707 Valid Authentication Medium 2024-07-19 – 58 CVE-2023-29489 XSS in cpanel at [www.███] - Securado, Oman Analysed #1982630 Valid Cross-site Scripting Medium 2023-06-09 – 58 SSRF to read AWS metaData at https://█████/ [HtUS] Analysed #1624140 Valid Server-Side Request Forgery Critical 2022-10-14 $1,000 57 Remote Code Execution through DNN Cookie Deserialization Analysed #876708 Valid Command and Code Injection High 2020-05-27 – 56 Sensitive data exposure: █████████ candidate resumes/CVs available to download with no authentication through BAC/IDOR/Improper Salesforce config Analysed #2623715 Valid Access Control High 2024-12-18 – 55 Reflected XSS via Keycloak on ███ [CVE-2021-20323] Analysed #2221104 Valid Cross-site Scripting Medium 2024-05-03 – 55 Sensitive data exposure via /secure/███████ endpoint on ████████ Analysed #1278952 Valid Information Disclosure Medium 2024-12-18 – 55 Subdomain takeover ██████ Analysed #2552243 Valid Misconfiguration and Insecure Design Critical 2024-07-26 – 53 Open Akamai ARL XSS on http://master-config-████████ Analysed #1315907 Valid Cross-site Scripting Medium 2024-07-26 – 53 XSS found for https://█████████ Analysed #2670521 Valid Cross-site Scripting Medium 2024-08-29 – 51 Local File Disclosure on the █████ (https://████████.edu/) leads to the full source code disclosure and credentials leak Analysed #684836 Valid Information Disclosure Critical 2024-06-27 – 51 XSS on ███████ Analysed #2615670 Valid Cross-site Scripting Medium 2024-08-29 – 48 Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████] Analysed #2354136 Valid Authentication Critical 2024-03-22 – 48 Log4Shell: RCE 0-day exploit on █████████ Analysed #1429014 Valid Command and Code Injection Critical 2022-01-03 – 48 Information disclousure by clicking on the link shown in http://████████/ Analysed #708019 Valid Information Disclosure High 2019-12-02 – 48 Local File Inclusion vulnerability on an Army system allows downloading local files Analysed #183978 Valid Information Disclosure High 2017-01-06 – 48 Unauthenticated Access to Admin Panel Functions at https://██████████/████████ Analysed #1394910 Valid Access Control Critical 2021-11-29 – 47 Reflected Cross-site Scripting via search query on ██████ Analysed #2434904 Valid Cross-site Scripting Medium 2024-05-03 – 45 Remote Code Execution via Insecure Deserialization in Telerik UI Analysed #838196 Valid Deserialization and Object Injection Critical 2020-05-07 – 45 SQL Injection vulnerability located at ████████ Analysed #384397 Valid SQL Injection High 2019-08-15 – 45 Reflected XSS on error message on Login Page Analysed #2417864 Valid Cross-site Scripting Medium 2024-05-03 – 44