Stored Xss Vulnerability on ████████ Analysed #380103 Valid Cross-site Scripting – 2020-05-14 – 192 Bypassing CORS Misconfiguration Leads to Sensitive Exposure Analysed #768151 Valid Input Validation and Logic – 2020-05-14 – 145 Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.mil Analysed #2950536 Valid Access Control Critical 2025-02-12 – 142 Public instance of Jenkins on https://██████████/ with /script enabled #768266 Valid Command and Code Injection – 2020-01-31 – 118 Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/ #2083771 Valid Command and Code Injection Critical 2024-12-18 – 114 [hta3] Remote Code Execution on ████ #1072832 Valid Command and Code Injection – 2023-05-15 – 104 Wordpress Takeover using setup configuration at http://████.edu [HtUS] #1626205 Valid Misconfiguration and Insecure Design – 2023-01-13 $1,000 102 Public google drive link Exposes Military Orders Containing PII (Name, SSN etc..) and Operational Details #2926447 Valid Information Disclosure Critical 2025-01-24 – 99 Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeover #2748003 Valid Information Disclosure Critical 2024-10-25 – 98 [███████] Information disclosure due unauthenticated access to APIs and system browser functions #2122964 Valid Information Disclosure Medium 2023-11-03 – 97 XXE in DoD website that may lead to RCE #227880 Valid Injection and Smuggling – 2019-10-04 – 97 Time based SQL injection at████████ #2312334 Valid SQL Injection High 2024-01-26 – 96 LOGJ4 VUlnerability [HtUS] #1624137 Valid Command and Code Injection – 2022-11-18 $1,000 94 Remote Code Execution in ██████ #710864 Valid Command and Code Injection – 2020-05-11 – 94 SQL Injection #2737595 Valid SQL Injection High 2024-10-25 – 91 ███ leaking PII of tour visitors (names, email addresses, phone numbers) via misconfigured record permissions #2294930 Valid Cryptography Critical 2024-03-22 – 90 User automatically logged in as Sys Admin user on https://███/Administration/Administration.aspx #2190808 Valid Access Control Critical 2023-11-03 – 88 CSRF leads to Account takeover #2699029 Valid Cross-Site Request Forgery High 2024-12-18 – 87 [SQLI ]Time Bassed Injection at ██████████ via referer header #995122 Valid SQL Injection – 2020-10-16 – 87 Remote Code Execution (RCE) in a DoD website #248116 Valid Command and Code Injection – 2019-10-04 – 84 Publicly Editable U.S. Air Force Google Spreadsheet Exposing Student Leave Data #2682079 Valid Access Control Medium 2025-02-12 – 83 Blind Sql Injection in https://████ #2597543 Valid SQL Injection Medium 2024-08-29 – 81 SQL Injection on www.██████████ on countID parameter #390879 Valid SQL Injection – 2019-10-08 – 80 Improper Authentication Allows Making Appeals as Other Users #2666323 Valid Authentication Medium 2025-02-12 – 77 IDOR leading unauthenticated attacker to download documents discloses PII of users and soldiers via https://www.█████████/Download.aspx?id= [HtUS] #1626508 Valid Insecure Direct Object Reference High 2024-06-27 $500 77 SQL Injection in ████ #419017 Valid SQL Injection – 2019-08-19 – 73 Full account takeover of any user through reset password #2194928 Valid Authentication Medium 2023-11-17 – 71 CVE-2020-3187 - Unauthenticated Arbitrary File Deletion #960330 Valid File and Path Handling – 2020-09-21 – 70 Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/` #2778380 Valid File and Path Handling High 2024-10-25 – 69 Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training) #1556950 Valid Misconfiguration and Insecure Design Critical 2025-01-24 – 69 RCE on █████ via CVE-2017-10271 #576887 Valid Command and Code Injection – 2019-07-01 – 68 CSRF leads to Account takeover #2712857 Valid Cross-Site Request Forgery High 2024-12-18 – 67 Boolen Based Blind Sql Injection Via User Agent in ███.mil #2599826 Valid SQL Injection Medium 2025-01-24 – 67 Improper Authentication (Login without Registration with any user) at ████ #2334420 Valid Authentication High 2024-03-22 – 67 [█████████] Administrative access to Oracle WebLogic Server using default credentials #804548 Valid Access Control – 2020-06-25 – 65 IDOR leads to PII Leak #2586584 Valid Insecure Direct Object Reference Medium 2024-07-19 – 64 Subdomain takeover ████████.mil #2499178 Valid Access Control Critical 2024-06-27 – 64 CVE-2020-7961 RCE Liferay Portal Unauthenticated via https://████████/ #2742457 Valid Command and Code Injection Critical 2024-10-25 – 62 Unauthenticated SQL Injection at █████████ [HtUS] #1626226 Valid SQL Injection – 2022-10-14 – 61 Authentication Bypass on https://███████/ #2414707 Valid Authentication Medium 2024-07-19 – 58 CVE-2023-29489 XSS in cpanel at [www.███] - Securado, Oman #1982630 Valid Cross-site Scripting Medium 2023-06-09 – 58 LFI with potential to RCE on ██████ using CVE-2019-3396 #538771 Valid File and Path Handling – 2019-10-04 – 58 SSRF to read AWS metaData at https://█████/ [HtUS] #1624140 Valid Server-Side Request Forgery – 2022-10-14 $1,000 57 Remote Code Execution through DNN Cookie Deserialization #876708 Valid Command and Code Injection – 2020-05-27 – 56 Sensitive data exposure: █████████ candidate resumes/CVs available to download with no authentication through BAC/IDOR/Improper Salesforce config #2623715 Valid Access Control High 2024-12-18 – 55 Reflected XSS via Keycloak on ███ [CVE-2021-20323] #2221104 Valid Cross-site Scripting Medium 2024-05-03 – 55 Sensitive data exposure via /secure/███████ endpoint on ████████ #1278952 Valid Information Disclosure Medium 2024-12-18 – 55 Time-based blind SQL injection #2759243 Valid SQL Injection Medium 2025-01-24 – 53 Subdomain takeover ██████ #2552243 Valid Misconfiguration and Insecure Design Critical 2024-07-26 – 53 Open Akamai ARL XSS on http://master-config-████████ #1315907 Valid Cross-site Scripting Medium 2024-07-26 – 53