The Hidden IDOR Vulnerability in /me/ API Endpoints
Medium2026-11-01
Web, API
Not rated
BUG BOUNTY WRITEUPS
Real bugs.
Real writeups.
EXPLORE THE ARCHIVE
Find a writeup
Search by bug, platform or sourceResearch library
External links open the original source2,817 writeups indexed, newest first
Request Smuggling in 2026: Four Bugs, Four Layers, One Seam
Medium2026-11-01
Web
Not rated
Web, API
Not rated
Android
Not rated
60,000+ WordPress Attack Attempts in 24 Hours: Critical RCE Vulnerability Puts Websites on Alert
Medium2026-10-31
Web
Not rated
The Debugging File Nobody Removed Before Shipping: Secrets Exposed Through a Public Source Map
Medium2026-10-31
Web
Not rated
The JWT Bug I Almost Walked Past : And Why Most Developers Still Get This Wrong
Researcher blog2026-10-31
Web
Not rated
SQLMap 1 ~ CyLab Security Academy Write-up | Exploiting SQL Injection and Accessing Protected Data
Medium2026-10-30
Web
Not rated
Web
Not rated
launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API
HackerOneBasecamp2026-10-30
Web, API
High
Translation discovery crashes on crafted filenames (regex substitution injection)
HackerOneWeblate2026-10-30
Web
Low
Web, API
Not rated
Beyond the Syllabus: SQL Injection, Zero Trust and a 1-Week Bootcamp | GCF Parul University (Part…
Medium2026-10-30
Web
Not rated
Web
Not rated
The Race Condition That Paid Its Own Bounty
Medium2026-10-30
Web
Not rated
wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list
HackerOneWordPress2026-10-30
Web
Medium
Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.
HackerOneWeblate2026-10-30
Web
Medium
Web, API
Not rated
Cross-account webhook takeover: PUT and DELETE on / /webhooks/ .json reach another account's webhook
HackerOneBasecamp2026-10-30
Web
High
wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.
HackerOneWeblate2026-10-30
Web
Low
CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content
HackerOneWordPress2026-10-30
Web
Medium
Windows
Not rated
Mastering Open Redirect Vulnerabilities: From Simple Bypasses to Critical Bug Bounties
Medium2026-10-30
Web
Not rated
A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option
HackerOneBasecamp2026-10-30
Web
High
GraphQL Vulnerabilities: The Bug Class Most Hunters Still Don’t Know How to Test
Researcher blog2026-10-29
Web, API
Not rated
Web
Not rated
Practical Bug Bounty Hunting: Finding API Leaks, PII Exposure, and Password Reset Vulnerabilities
Medium2026-10-29
Web, API, AI
Not rated
Revoked deployment collaborator regains access to private comments after active collaborator interaction
HackerOneVercel2026-10-29$1,026 bounty
Web
Medium
Web
Not rated
Web, API
Not rated
Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce
HackerOneBasecamp2026-10-28
Web
High
Launchpad file read leaks production keys
HackerOneBasecamp2026-10-28$9,337 bounty
Web
Critical
Pwning 15M+ Systems by Renaming a Song: From a CMS Audit to an Upstream RCE in getID3…
Medium2026-10-28
Web
Not rated
From POST-Based XSS to Full Account Takeover
Medium2026-10-28
Web
Not rated
Web
Not rated
How a Sneaker Order Led Me to an IDOR Vulnerability (and $50)
Medium2026-10-28
Web
Not rated
How to Find SSRF Bugs That Pay: Hunting Server Side Request Forgery in URL Fetch and Image Import…
Medium2026-10-28
Web
Not rated
Web
Not rated
Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM
HackerOneMonero2026-10-28
Web3
High
CSRF and XSS: How a Valid Login Can Be Misused
Medium2026-10-27
Web
Not rated
Permission Model filesystem over-grant via wildcard radix lookup
HackerOneNode.js2026-10-27
Web
Low
Understanding BOLA in Spring Boot: From Vulnerable Endpoints to Ownership-Based Authorization
Medium2026-10-27
Web, API
Not rated
Unauthenticated Persistent Denial-of-Service via Federated Share Injection
HackerOneNextcloud2026-10-27
Web, Cloud
High
Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host
HackerOnecurl2026-10-27
Web
Low
Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API
HackerOneNextcloud2026-10-27
Web, API, Cloud
Low
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
Researcher blog2026-10-27
Web
Not rated
No password confirmation required when using apptoken on sensitive endpoint
HackerOneNextcloud2026-10-27
Web, API, Cloud
Medium
Tables application does not respect sharing limitations set by admin
HackerOneNextcloud2026-10-27
Web, Cloud
Medium
>> XSS vs SQL Injection (SQLi): Understanding Two Common Web Application Vulnerabilities
Medium2026-10-27
Web
Not rated
Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone
HackerOneNextcloud2026-10-27
Web, API, Cloud
Medium
These are links to public research, not copies of the reports. The index refreshes automatically several times a day. Severity comes from the disclosing platform (HackerOne rating); articles without a platform rating stay "Not rated".