An unauthenticated write to a content management system's visual page-design plugin planted a stored cross-site scripting payload that ran as a logged-in administrator, escalating to backoffice takeover and server-side code execution.
Jun 1, 2026A secret access key left inside a public website chained into unauthenticated super-admin control of the content system and arbitrary SQL injection on the production database.
May 24, 2026A missing ownership check let any single login at a mobile carrier read the name, phone number, plan and billing details of every subscriber by changing one number in the request.
May 24, 2026A public content API leaked an administrator's private password-reset token one character at a time, enabling a full unauthenticated takeover of a headless CMS that escalated to production SQL injection.
May 23, 2026A business-logic flaw let any free account mint permanent, signed reward perk URLs for a paid membership tier, with a self-chosen far-future expiry that survived account deletion and had no rate limit.
May 23, 2026A public share link on a major news site's AI chat product leaked the owner's internal user id, which then unlocked unauthenticated read, planting, and deletion of every conversation that user ever had, including chats that were never shared.
May 22, 2026An enterprise identity service exposed encrypt and decrypt endpoints to every tenant under one shared master key with no context binding, letting any customer recover any other customer's live API credentials.
May 20, 2026An insurer's quote-store endpoint accepted writes against any customer's identifier with no ownership check, letting any anonymous visitor silently poison any in-flight quote across five sibling brands.
May 20, 2026Three GraphQL resolvers on a feature-flag and observability platform were missing authentication, exposing 15,915 cross-tenant records and accepting persistent writes from any unauthenticated caller.
May 20, 2026A retrieve-quote API was vulnerable to error-based SQL injection on the insurer's production database, exposing hundreds of tables across all sibling brands to unauthenticated reads.
May 19, 2026