Found vulnerabilities
Real-world vulnerabilities we've found, how we found them, and the tools behind them — plus the occasional bug bounty writeup.
Motokeska.cz – Payment Bypass for Free Vouchers, Plus QR Token Leaks and Location Exposure
Five flaws on motokeska.cz: a payment bypass handing out free vouchers, leaked QR tokens, and profile photos exposing GPS location.
Livesport bug bounty – Directory traversal at lsid.eu
Directory Traversal vulnerability was identified and responsibly reported through Livesport’s official bug bounty program.
Livesport - Vertical privilege escalation(s)
Business logic flaw that allowed manipulation with bonuses and competition results.