Hall of Fame

• 2024-11-26 - Hassan Jaleel - TLS-RPT record missing - €0.00
• 2024-05-26 - Pruthu Raut - MTA-STS record missing - €10.00
• 2024-05-17 - Himanshu Sondhi - SRI missing - €0.00
• 2024-05-17 - Himanshu Sondhi - Outdated jQuery library - €0.00
• 2023-12-25 - Mridul Rastogi - Password recovery process info leak - €0.00
• 2021-07-14 - Kiran Ghimire - Registration process logical issue - €0.00
• 2021-06-25 - Kunal Mhaske - Session expiration when changing password - €25.00
• 2021-01-18 - Prajwal Khante - HTML injection (XSS) with HTTP Referer header - €20.00
• 2020-12-09 - Zin Min Phyo - Filetype (mime/extension) confusion when uploading evidencing files - €15.00
  Reported also by:
  • 2020-12-22 - Akash Chauhan
• 2020-10-01 - Kinshuk Kumar - E-mail sent links not expiring - €15.00
• 2020-09-12 - Aditya Soni - crash in the password reset field using IDN homographic value - €10.00
• 2020-09-02 - Akshay Parse - user's fullname length was restricted too little - €5.00
• 2020-08-30 - Akshay Parse - registration process logical flaw - €15.00
  Reported also by:
  • 2023-12-25 - Milan Jain
• 2020-08-09 - Rashid P - WP-Cron exposal / DoS risk - €5.00
• 2020-08-08 - Kinshuk Kumar - missing DMARC policy on associated domain - €0.00
• 2020-08-07 - Sai ViNay Reddee - regression on session fixation - €10.00
• 2020-07-10 - Ronit Bhatt - hyperlink injection in user's name - €20.00
• 2020-07-08 - Keshav Malik - Account Lockout not Being Enforced - €25.00
• 2020-07-08 - Keshav Malik - password complexity not validated - €15.00
  Reported also by:
  • 2020-07-15 - Nishant N. Lungare
• 2020-07-06 - Keshav Malik - session fixation / invalidate user sessions on logout - €20.00
• 2020-07-02 - Akshay Parse - no rate limit on form submit actions - €25.00
  Reported also by:
  • 2020-07-06 - Keshav Malik
  • 2020-07-06 - Ajaysen R
• 2020-07-01 - Aamir Usman Khan - stored XSS in document info - €20.00
• 2020-07-01 - Aamir Usman Khan - password length policy - €5.00
• 2020-06-28 - Bilal Abdul Muqeet - WP JSON API allowed for unauthenticated users - €10.00
• 2020-06-25 - Kunal Mhaske - invalidate all user sessions once the new password is set - €30.00
• 2020-05-14 - Kunal Mhaske - incorrect security on refererr, switched to origin-when-cross-origin - €25.00
• 2020-03-11 - Kunal Mhaske - email bombing on forgot password function - €10.00
• 2020-03-01 - Kunal Mhaske - missing DMARC policy on certifix.eu/certifix.cz - €10.00