When a WordPress 0day dropped, I ran it across my target's subdomains and found two vulnerable hosts — leading to unauthenticated database extraction on a Mars (Royal Canin) domain.
Wayback Machine recon led to hidden admin endpoints. A simple switch from GET to POST bypassed all access controls, leaking thousands of customer records from a REACTED promotion campaign.
A previously reported AWS credentials leak was marked as resolved, but the credentials were never rotated. I verified they still worked and could inject data into the production logging stream.
A car marketplace contact form rendered HTML in email notifications — I hesitated to report it, but it turned out to be a valid finding.
While testing file upload forms across a platform, I uploaded an SVG with a JavaScript payload — it got served from the CDN without sanitization, triggering stored XSS.
Two CSRF vulnerabilities on a car marketplace — one allowed modifying other users' listings (CSRF + IDOR), the other silently added cars to a victim's saved list.
A state-changing API endpoint in a web application editor had no CSRF protection at all, allowing attackers to silently inject data into victim accounts via a simple HTML form.
While editing a post, I noticed the imageUrls parameter was already in the request body — empty. Non-premium users shouldn't be able to set it, but the API accepted it without checking.
Inspired by another report, I deleted my own account and replayed saved Burp requests — the bearer token was still valid, allowing post-deletion modifications.