Writeups
Unauthenticated Admin API Access via HTTP Verb Tampering
Wayback Machine recon led to hidden admin endpoints. A simple switch from GET to POST bypassed all access controls, leaking thousands of customer records from a REACTED promotion campaign.