Account Takeover in Password Reset Function #3228888 Valid Authentication Critical 2025-09-02 – 105 Reflected HTML Injection via contact (faq) search parameter on ██████████ #2587101 Valid Cross-site Scripting Medium 2024-11-25 – 103 █████████ when adding branches to your account #2756402 Valid Insecure Direct Object Reference Critical 2024-11-26 – 98 Reflected HTML Injection via contact (faq) search parameter on ███]= #2578985 Valid Cross-site Scripting Medium 2024-11-25 – 82 Unrestricted File Upload at ██████████ #2357778 Valid File and Path Handling – 2024-02-19 – 78 sqli on █████████ search functionality #2446550 Valid SQL Injection Medium 2024-06-25 – 72 RXSS on ██████ via customerId parameter #3126603 Valid Cross-site Scripting Medium 2025-07-28 – 71 CVE-█████-35813 in █████ #2200329 Valid File and Path Handling Critical 2026-02-24 – 71 Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314 #1452774 Valid Information Disclosure Medium 2025-09-02 – 67 Upload profile photo and Pets addition - IDOR #2393021 Valid Insecure Direct Object Reference High 2024-11-21 – 66 Bug Report #23JAN136 (subdomain takeover via shopify ) #1851895 Valid Access Control High 2025-09-02 – 63 SQLi At `███████` via `theme_name` #3293803 Valid SQL Injection Critical 2026-02-24 – 62 Attacker can add two free bags offered by the site at the same time. #2402010 Valid Input Validation and Logic Medium 2024-06-25 – 62 Insecure API Response Leads to Disclosure of Hashed Passwords #2788557 Valid Information Disclosure Medium 2024-11-26 – 61 CSRF to delete a pet on ██████ #2261600 Valid Cross-Site Request Forgery – 2024-02-05 – 61 insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218) #3090123 Valid Deserialization and Object Injection Critical 2025-05-12 – 59 0 Click account takeover via timed requests to ███████forgot-password (single-packet attack) #2142109 Valid Cryptography High 2024-07-11 – 58 [XSS] Reflected XSS via POST request in (███████) #3146996 Valid Cross-site Scripting Medium 2025-06-12 – 54 unauthorized access and add user and change personal information all users #2828641 Valid Access Control Critical 2025-05-27 – 54 change part of personal information all users #2828693 Valid Access Control Critical 2025-05-12 – 53 RXSS on ████ via configUrl parameter #2684274 Valid Cross-site Scripting Low 2024-11-26 – 53 Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████ #2262554 Valid Authentication – 2024-01-30 – 53 phpinfo() exposed on ██████████ #2641211 Valid Misconfiguration and Insecure Design Medium 2024-11-21 – 51 Bug Report #23JAN135 (subdomain takeover via shopify ) #1851886 Valid Access Control High 2025-09-02 – 50 Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses #3360293 Valid Information Disclosure Medium 2026-02-24 – 49 Sqli on ██████ search functionality #2453475 Valid SQL Injection Medium 2024-06-25 – 47 Datadog api keys exposed can be used to do all the read and write access to the instance #2307933 Valid Information Disclosure – 2024-01-25 – 47 unsubscribe anyone from all ████████ emails @ █████ #2354888 Valid Access Control Low 2024-11-25 – 45 IDOR to account takeover on POST to █████████ by changing member_id parameter #2132183 Valid Insecure Direct Object Reference – 2024-01-30 – 45 IDOR in one subdomain of █████████ -> change information of pets without athorization! #2073950 Valid Insecure Direct Object Reference – 2024-02-14 – 45 SQLi at █████ parameter #3277276 Valid SQL Injection Critical 2026-02-24 – 42 Account takeover using reset password link #2341038 Valid Open Redirect Medium 2024-06-25 – 41 debug.log leaked [█████████] #3063026 Valid Information Disclosure Low 2025-05-12 – 40 Users Data Exposure via Insecure Endpoint #2828608 Valid Information Disclosure Medium 2025-05-12 – 40 RXSS on stores on *█████████/visitorRegistration.pml via destination parameter #2189797 Valid Cross-site Scripting Medium 2025-09-02 – 40 subdomain takeover at █████████ #2106886 Valid Misconfiguration and Insecure Design – 2023-11-15 – 40 Client Side Template Injection to Stored XSS in Image Collection #2234564 Valid Cross-site Scripting – 2024-02-14 – 39 RXSS on ████ via q parameter #2166843 Valid Cross-site Scripting Low 2024-11-21 – 39 debug.log File Exposure that exposes (user/████) username and password at █████████ #2122938 Valid Cryptography – 2023-11-15 – 39 RXSS in ███ via S parameter #2307913 Valid Cross-site Scripting Medium 2024-11-19 – 38 massive PII leakage for ███████ #2887506 Valid Information Disclosure Medium 2025-05-12 – 36 phpinfo() exposed on ██████████ #2666151 Valid Misconfiguration and Insecure Design – 2024-11-21 – 36 Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint #3376598 Valid Cryptography Medium 2026-02-24 – 35 Reflected xss on ████████ #2389897 Valid Cross-site Scripting Medium 2024-06-25 – 33 Sensitive Information Exposed at █████ #2308654 Valid Information Disclosure – 2024-01-30 – 33 Order More Than Maximum Allowed Quantity #3185001 Valid Input Validation and Logic – 2025-09-02 – 32 CSRF in Delete Pet Function #2445106 Valid Cross-Site Request Forgery Medium 2024-11-19 – 32 ████ ' can change any account email and cannot retrieve his account and access it ' at ███ #1952771 Valid Insecure Direct Object Reference – 2023-06-23 – 32 CVE-2022-21371: Oracle WebLogic Server Local File Inclusion #2387600 Valid No weakness recorded – 2024-03-04 – 30 ███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration #3066548 Valid Information Disclosure Medium 2026-02-24 – 29