RichText parser vulnerability in scheduled posts allows XSS Analysed #1930763 Valid Cross-site Scripting High 2023-04-20 $5,000 280 Deleting all DMs on RedditGifts.com Analysed #1213237 Valid Insecure Direct Object Reference High 2021-10-21 $5,000 267 XSS via Mod Log Removed Posts Analysed #1504410 Valid Cross-site Scripting High 2022-03-10 – 218 IDOR allows an attacker to modify the links of any user Analysed #1661113 Valid Insecure Direct Object Reference High 2022-09-30 – 208 Able to bypass email verification and change email to any other user email Analysed #1551176 Valid Access Control High 2022-05-06 $5,000 200 Able to approve admin approval and change effective status without adding payment details . Analysed #1543159 Valid Input Validation and Logic High 2022-06-22 $5,000 191 Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability Analysed #1658418 Valid Insecure Direct Object Reference High 2022-08-04 $5,000 163 Reddit talk promotion offers don't expire, allowing users to accept them after being demoted Analysed #1656380 Valid Insecure Direct Object Reference Medium 2022-10-03 – 72 GPS metadata preserved when converting HEIF to PNG Analysed #1069039 Valid Information Disclosure High 2021-10-21 – 67 Image queue default key of 'None' and GraphQL unhandled type exception Analysed #996041 Valid Memory Corruption Medium 2021-10-27 $500 65 Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API Analysed #1298902 Valid Access Control Low 2021-10-27 – 52 Hash-Collision Denial-of-Service Vulnerability in Markdown Parser Analysed #1341957 Valid Denial of Service Medium 2021-10-21 – 44 IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter Analysed #1213765 Valid Input Validation and Logic Medium 2021-10-21 $500 42 Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase Analysed #801743 Valid Race Conditions Medium 2021-10-27 – 42 [dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User Profile Analysed #1237428 Valid Denial of Service High 2021-12-13 – 33 Third party app could steal access token as well as protected files using inAppBrowser Analysed #1122177 Valid Information Disclosure Medium 2021-10-27 – 32