XSS
An avatar that executed on the help desk
SVG accepted as a profile picture, served inline from the same origin, and rendered to whoever opened the ticket.
· 2 min read $500 - $1k
Writeups
13 writeups
Info leak
Adding .css to a settings page and getting someone else's
The CDN cached anything that looked like a static file. The origin ignored the extension and rendered the account page anyway.
· 2 min read $1k - $2.5k
Race
A webhook that could be replayed for eleven minutes
The signature was verified, the timestamp was not, and the idempotency key was checked after the credit was applied.
· 2 min read $500 - $1k
IDOR
Sequential invoice IDs, and no check at all
The least sophisticated bug on this blog. Decrement the number in the URL, read somebody else's invoice.
· 1 min read under $500