Etiqueta: Apprentice

User ID controlled by request parameter with data leakage in redirect

User ID controlled by request parameter, with unpredictable user IDs

User ID controlled by request parameter

User role can be modified in user profile

User role controlled by request parameter

Unprotected admin functionality with unpredictable URL

Unprotected admin functionality

Exploiting NoSQL operator injection to bypass authentication

Detecting NoSQL injection

Stored XSS into anchor href attribute with double quotes HTML-encoded