bug-bounty622
facebook466
xss316
google157
microsoft104
rce102
apple62
csrf60
web355
account-takeover53
writeup51
exploit43
sqli41
dos34
ssrf34
cve33
cloudflare32
privilege-escalation29
defi28
malware26
smart-contract-vulnerability25
idor25
node25
subdomain-takeover24
clickjacking23
smart-contract23
ethereum23
access-control21
vulnerability-disclosure21
auth-bypass19
reverse-engineering19
react19
remote-code-execution18
aws18
lfi18
cloud17
cors17
info-disclosure16
oauth16
race-condition16
supply-chain15
docker14
authentication-bypass14
solidity14
browser13
phishing13
denial-of-service11
sql-injection11
delegatecall11
wordpress10
0
5/10
A researcher discovered a reflected XSS vulnerability in a language parameter that was cached by the web server, escalating it to account takeover by leveraging web cache poisoning to persist the malicious payload across all users visiting the site, exploiting missing HttpOnly/Secure cookie flags and lack of CSP.