Open memory dump method leaking customer information ,secret keys , password , source code & admin accounts Analysed #783360 Valid Access Control Critical 2020-01-31 – 158 Public and secret api key leaked in JavaScript source Analysed #983331 Valid Cryptography Medium 2020-09-29 – 148 [Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project. Analysed #3459285 Valid Access Control Critical 2026-01-20 – 140 [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier Analysed #2932960 Valid Server-Side Request Forgery Critical 2025-12-01 – 92 stripo.email reflected xss Analysed #714521 Valid Cross-site Scripting Medium 2019-12-26 – 70 No length on password Analysed #738569 Valid No weakness recorded Medium 2019-12-23 – 64 Able to change password by entering wrong old password Analysed #738899 Valid Cryptography – 2019-12-18 – 56 No rate limiting for subscribe email + lead to Cross origin misconfiguration Analysed #1029723 Valid Input Validation and Logic Medium 2020-11-30 – 54 Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/] Analysed #1009046 Valid Input Validation and Logic High 2021-01-25 – 51 [www.stripo.email] There is no rate limit for contact-us endpoints Analysed #856305 Valid Access Control Low 2020-05-26 – 47 Bypassing Content-Security-Policy leads to open-redirect and iframe xss Analysed #1166766 Valid Open Redirect Medium 2021-07-30 – 36 subdomain takeover at status0.stripo.email Analysed #737695 Valid Access Control Medium 2019-12-23 – 36 [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header. Analysed #855013 Valid Access Control Medium 2020-04-23 – 34 Upload Profile Photo in any folder you want with any extension you want Analysed #753375 Valid Access Control Critical 2022-03-30 – 33 [SSRF] my.stripo.email via the setup-wizard parameter Analysed #1622432 Valid Server-Side Request Forgery Critical 2024-02-15 – 29 Memory Dump and Env Disclosure via Spring Boot Actuator Analysed #1019367 Valid Misconfiguration and Insecure Design Medium 2021-03-02 – 27 Stored XSS in the banner block description Analysed #1065964 Valid Cross-site Scripting Medium 2021-03-09 – 25 SSRF & unrestricted file upload on https://my.stripo.email/ Analysed #771382 Valid Server-Side Request Forgery Critical 2020-02-19 – 24 Stored XSS at Module Name Analysed #1126433 Valid Cross-site Scripting Medium 2021-04-12 – 23 weak password poilicy in signup password leak to account takeover Analysed #985367 Valid Misconfiguration and Insecure Design None 2020-10-16 – 23 SSRF external interaction Analysed #1023920 Valid Server-Side Request Forgery Low 2020-12-11 – 21 Improper Authorization #751299 Valid Access Control High 2020-02-03 – 20 Password token leak via Host header #737042 Valid Misconfiguration and Insecure Design Medium 2019-12-19 – 20 Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/ #1076047 Valid Input Validation and Logic Medium 2021-01-13 – 19 Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo #1047125 Valid Cryptography Medium 2020-12-04 – 19 [demo.stripo.email] HTTP request Smuggling #1631228 Valid Injection and Smuggling Medium 2024-02-15 – 18 No rate limiting - Create data #1047100 Valid Input Validation and Logic Medium 2021-01-05 – 18 Bypass email verification and create email template with the editor #737169 Valid No weakness recorded High 2019-12-19 – 18 No rate limit in email subscription #1047124 Valid Input Validation and Logic Medium 2021-01-11 – 16 subdomain takeover at status-stage0.stripo.email #781614 Valid Access Control Medium 2020-01-30 – 16 Ability to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referral #1166993 Valid Input Validation and Logic High 2022-03-30 – 15 HTTP Request Smuggling on my.stripo.email #777651 Valid No weakness recorded High 2020-04-10 – 15 csrf bypass using flash file + 307 redirect method at plugins endpoint #766205 Valid Cross-Site Request Forgery Medium 2020-02-10 – 15 OLD SESSION DOES NOT EXPIRE AFTER PASSWORD CHANGE #737039 Valid No weakness recorded Medium 2019-12-19 – 15 No Rate Limiting on /reset-password-request/ endpoint #764122 Valid Misconfiguration and Insecure Design Medium 2020-02-04 – 14 Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo #1709815 Valid Cryptography Medium 2024-02-15 – 13 Non-revoked API Key Information disclosure via Stripo_report() #1613714 Valid Cryptography Medium 2022-08-25 – 13 Stored XSS at "Conditions " through "My Custom Rule" Field at [https://my.stripo.email/cabinet/#/template-editor/] in Template Editor. #996371 Valid Cross-site Scripting Medium 2020-12-24 – 13 Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKEN #915541 Valid Access Control High 2020-07-27 – 13 CSRF - Modify Project Settings #766533 Valid Cross-Site Request Forgery Critical 2020-02-03 – 13 SSRF in Export template to ActiveCampaign #754025 Valid Server-Side Request Forgery Medium 2020-04-10 – 13 stripo blog search SQL Injection #761382 Valid SQL Injection Medium 2020-01-30 – 12 No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address #753386 Valid Cross-Site Request Forgery Medium 2020-09-08 – 12 Redirection through referer tag #737578 Valid No weakness recorded Low 2019-12-18 – 12 SSRF in /cabinet/stripeapi/v1/siteInfoLookup?url=XXX #738553 Valid Server-Side Request Forgery Medium 2019-12-18 – 11 Unrestricted File Upload on https://my.stripo.email and https://stripo.email #823588 Valid File and Path Handling Medium 2020-04-13 – 9 [www.stripo.email] You can bypass the speed limit by changing the IP. #881186 Valid Information Disclosure Medium 2020-06-30 – 8 Authorization for wp-admin directory are vulnerable to brute force. #788420 Valid Authentication High 2020-02-05 – 8 Insecure Storage and Overly Permissive API Keys #1283575 Valid Cryptography Medium 2022-03-30 – 7 No rate limiting - Create Plug-ins #1047119 Valid Input Validation and Logic Medium 2021-01-05 – 7