Hackerone Reports

🎯 New Report #3867358: MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the Service
🔺Severity: Medium
👽 Reporter: xlabai
⭐️ Reputation: 158
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-16
⏰ Disclosed: 2026-10-07 20:01:50
📝 Summary: A low-privilege database user was able to exhaust memory on a MariaDB server through the SFORMAT() function by specifying an extremely large width parameter. The function attempted to allocate nearly 2 GB of memory before generating the return value. Multiple concurrent requests caused the database process to be terminated by the system's out-of-memory mechanism, resulting in service unavailability. The vulnerability required only basic database login privileges and the ability to execute standard SELECT queries. No administrative access, table privileges, or user interaction was necessary to exploit this denial-of-service condition.
📂 Report JSON File: 3867358
@hackeronereports

🎯 New Report #3867363: MariaDB HandlerSocket Improper Request Field-Count Validation Causes Server Crash
🔺Severity: Medium
👽 Reporter: xlabai
⭐️ Reputation: 158
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-16
⏰ Disclosed: 2026-10-07 20:03:17
📝 Summary: A vulnerability was discovered in MariaDB Server's optional HandlerSocket plugin that allowed improper validation of request field-count parameters. When processing exec requests, the plugin allocated stack memory based on a client-supplied field count before validating whether the count was reasonable. An attacker could send requests with abnormally large field counts to cause the MariaDB process to crash, resulting in database service denial of service. The vulnerability affected deployments with HandlerSocket enabled, and could be exploited by unauthenticated attackers if no authentication secret was configured.
📂 Report JSON File: 3867363
@hackeronereports

🎯 New Report #2814774: Possible DoS in NumberHelpers
🔺Severity: Medium
👽 Reporter: manun
⭐️ Reputation: 209
🛠 State: resolved
💼 Team: Ruby on Rails
💵 Bounty: null
🕐 Submitted: 2024-10-31
⏰ Disclosed: 2026-10-06 18:43:32
📝 Summary: A denial of service vulnerability was discovered in Active Support's number helpers. The vulnerability allowed strings in scientific notation to be accepted and processed, which could cause excessive memory consumption or CPU exhaustion. The issue was addressed in patched versions where number helpers now treat strings containing scientific notation characters as non-numeric input and return them unchanged.
📂 Report JSON File: 2814774
@hackeronereports

🎯 New Report #3802451: HTML Injection in Contact Form Email Enables Phishing via Legitimate ████████ Infrastructure
🔺Severity: Medium
👽 Reporter: tenzai
⭐️ Reputation: 1445
🛠 State: resolved
💼 Team: Essity
💵 Bounty: null
🕐 Submitted: 2026-06-14
⏰ Disclosed: 2026-10-05 11:34:09
📝 Summary: An HTML injection vulnerability was discovered in a contact form email endpoint. The firstName field was rendered as unescaped HTML in transactional confirmation emails sent via SendGrid. Anchor tags with inline styles were not sanitized and persisted in email clients, allowing styled links to be injected into legitimate branded emails. The endpoint accepted requests without authentication, CAPTCHA, or rate limiting. Image tags were stripped by the email pipeline, but anchor tags survived with attacker-controlled styling and href attributes that were rewritten through SendGrid's click tracking proxy.
📂 Report JSON File: 3802451
@hackeronereports

🎯 New Report #3987499: Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset Endpoint
🔺Severity: High
👽 Reporter: letx world
⭐️ Reputation: 102
🛠 State: resolved
💼 Team: Khan Academy
💵 Bounty: null
🕐 Submitted: 2026-09-01
⏰ Disclosed: 2026-10-05 02:23:43
📝 Summary: A client-side denial of service vulnerability was identified on a password reset endpoint. When the endpoint was accessed by an authenticated user, the browser automatically generated thousands of requests without user interaction, resulting in rapid memory exhaustion. The browser became unresponsive and crashed within minutes as memory usage continuously increased.
📂 Report JSON File: 3987499
@hackeronereports

🎯 New Report #3766217: libmariadb ( mariadb-connector-c ): stack overflow via server-controlled field->length in prepared-statement codec
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 729
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-05-28
⏰ Disclosed: 2026-10-04 07:44:56
📝 Summary: A stack overflow vulnerability was discovered in the prepared-statement codec of the database connector library. The vulnerability allowed a malicious database server or network attacker to crash client applications by sending specially crafted column-definition packets with excessively large field-length values. When clients attempted to fetch query results, the field-length value was read without validation and passed directly to a stack allocation function, causing immediate process termination. The issue affected multiple versions of the connector library and downstream applications using prepared statements for database queries.
📂 Report JSON File: 3766217
@hackeronereports

🎯 New Report #3678395: Path Traversal in mbstream Extract
🔺Severity: High
👽 Reporter: riscj
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-04-16
⏰ Disclosed: 2026-10-03 12:57:48
📝 Summary: A path traversal vulnerability was discovered in the extraction code of a database backup utility. The vulnerability allowed malicious archive files to create files outside the intended target directory by using relative path traversal sequences. The flaw existed in the file path validation logic, which failed to reject directory traversal components in archive chunk paths. When extraction was performed, these traversal sequences were resolved by the kernel to write files to arbitrary locations on the filesystem where the extracting user had permissions. The vulnerability was confirmed to enable root-level command execution when extraction was performed with elevated privileges, through the creation of malicious configuration files in system directories.
📂 Report JSON File: 3678395
@hackeronereports

🎯 New Report #3943339: One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML
🔺Severity: High
👽 Reporter: pirikara
⭐️ Reputation: 809
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: null
🕐 Submitted: 2026-08-16
⏰ Disclosed: 2026-10-02 17:19:17
📝 Summary: A cross-account JavaScript execution vulnerability was discovered in a web application that allowed arbitrary code execution when a victim opened a crafted public board URL. An attacker with a separate account could leverage this vulnerability to steal the victim's write access token through a combination of flaws involving pagination parameter handling, unattached Active Storage HTML files, and inadequate MIME type validation. The stolen token was used to create, read, and delete data across the victim's accounts without authorization. The vulnerability required victim interaction through opening a single URL and affected confidentiality and integrity of victim data across unrelated accounts.
📂 Report JSON File: 3943339
@hackeronereports

🎯 New Report #3862641: IDOR allows user to access report details via reference.json endpoint
🔺Severity: Critical
👽 Reporter: sm41ldrag0n79 mbbank
⭐️ Reputation: 159
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 15000
🕐 Submitted: 2026-07-14
⏰ Disclosed: 2026-10-01 01:27:40
📝 Summary: An information disclosure vulnerability was identified in a report details endpoint that allowed unauthorized users to access private report information. Despite the endpoint returning an access-denied error response, sensitive report details were inadvertently exposed in the error message body. The vulnerability was discovered through testing with standard user accounts and has since been fixed. No evidence of exploitation was found.
📂 Report JSON File: 3862641
@hackeronereports

🎯 New Report #3623149: SSRF via User-Controlled Push proxyServer in Notifications Push Registration
🔺Severity: Medium
👽 Reporter: yoyomiski
⭐️ Reputation: 1101
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-23
⏰ Disclosed: 2026-09-30 15:43:58
📝 Summary: A server-side request forgery vulnerability was discovered in the notifications application version 5.0.0. An authenticated user with low privileges could register a push device with an attacker-controlled proxy server address through the push registration endpoint. When a notification was triggered for that user, the backend performed an outbound POST request to the attacker-specified proxy server address, allowing the backend to make HTTP requests to arbitrary destinations including internal services.
📂 Report JSON File: 3623149
@hackeronereports

🎯 New Report #3896671: Connector/C Out-of-bounds read in `unpack fields()` from short metadata field
🔺Severity: null
👽 Reporter: mschorm
⭐️ Reputation: 128
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-28
⏰ Disclosed: 2026-09-30 10:29:05
📝 Summary: A buffer over-read vulnerability was identified in the metadata field parsing function within the database connector library. The function processed fixed-header metadata without validating that the field data contained the required minimum length of 12 bytes. A malicious or compromised server could send truncated metadata fields and trigger out-of-bounds memory reads in the client process. This affected all versions through the current release branch and could result in information disclosure or client process crashes. The vulnerability required a malicious server connection or network position to exploit.
📂 Report JSON File: 3896671
@hackeronereports

🎯 New Report #3872239: Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 727
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-09-30 08:00:19
📝 Summary: MariaDB Connector/J was found to have an unbounded result-set field-count allocation vulnerability. When parsing result-set responses, the driver read the column count directly from the wire and used it to size a Java array without validation. A malicious server was able to declare an extremely large field count in a small packet, causing the client JVM to attempt a multi-gigabyte memory allocation and crash with OutOfMemoryError. The crash affected the entire JVM process, taking down all pooled connections and application threads. The vulnerability could be triggered at connection time during driver initialization, before any legitimate query execution and without requiring valid credentials. The driver's default plaintext mode made it susceptible to network-level attacks.
📂 Report JSON File: 3872239
@hackeronereports

🎯 New Report #4000185: HackerOne Code sends live password-reset tokens to Segment in automatic page events
🔺Severity: Low
👽 Reporter: 1rhino2
⭐️ Reputation: 138
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 200
🕐 Submitted: 2026-09-05
⏰ Disclosed: 2026-09-24 11:29:38
📝 Summary: A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page event, which could potentially be accessed by anyone with read access to the Segment telemetry during the token's validity window.
📂 Report JSON File: 4000185
@hackeronereports

🎯 New Report #3599470: Improper input validation in emoji field leads to sidebar UI denial of service
🔺Severity: Low
👽 Reporter: yoyomiski
⭐️ Reputation: 1091
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-12
⏰ Disclosed: 2026-09-20 10:04:20
📝 Summary: A vulnerability was discovered in the Collectives app version 4.0.0 where the emoji field in the page emoji update endpoint did not properly validate user input. An attacker could have submitted an excessively long string including newline characters instead of a valid emoji, causing the sidebar layout to become broken.
📂 Report JSON File: 3599470
@hackeronereports

🎯 New Report #3770482: files lock: a write-share collaborator can place a TYPE TOKEN lock that permanently denies the file owner, survives share revocation and account delet
🔺Severity: Medium
👽 Reporter: rz1027
⭐️ Reputation: 1452
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-05-29
⏰ Disclosed: 2026-09-18 15:36:09
📝 Summary: A vulnerability was discovered in files lock 33.0.4 on Nextcloud 33.0.3 that allowed a user with write-share permissions on a file to place a permanent lock on the file that could not be removed by the file owner or an administrator. The lock was stored in the database and persisted even after the collaborator's account was deleted or recreated. The only way to remove the lock was through direct database access, which was not documented in the application's administrative tools.
📂 Report JSON File: 3770482
@hackeronereports

🎯 New Report #3913012: Persistent SMTP header injection via identity `organization` / `name`
🔺Severity: None
👽 Reporter: dogeshark
⭐️ Reputation: 411
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-08-03
⏰ Disclosed: 2026-09-18 13:24:05
📝 Summary: A vulnerability was discovered in the Roundcube webmail client that allowed persistent SMTP header injection through the identity organization and name fields. The vulnerability was caused by insufficient validation of the user-supplied input, which resulted in the unfiltered data being stored and included in the email headers when sending messages. This issue could be exploited to inject arbitrary headers, such as forged Bcc or From, which would be sent with the server's SMTP submission credentials.
📂 Report JSON File: 3913012
@hackeronereports

🎯 New Report #4020767: Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████
🔺Severity: Critical
👽 Reporter: agusnicco
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Essity
💵 Bounty: null
🕐 Submitted: 2026-09-11
⏰ Disclosed: 2026-09-18 06:04:10
📝 Summary: An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message history of any conversation, create new conversations, and delete any conversation. The deletion of a conversation was incomplete, as the underlying messages remained retrievable even after the conversation was removed from the listing.
📂 Report JSON File: 4020767
@hackeronereports

🎯 New Report #3522157: SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )
🔺Severity: Medium
👽 Reporter: ferreiraklet
⭐️ Reputation: 3357
🛠 State: resolved
💼 Team: DuckDuckGo
💵 Bounty: 500
🕐 Submitted: 2026-01-23
⏰ Disclosed: 2026-09-17 22:54:11
📝 Summary: The web application was found to be vulnerable to server-side request forgery (SSRF). The SSRF vulnerability was discovered through testing with an HTTP interception proxy. The vulnerability allowed an attacker to make arbitrary HTTP requests from the server, which could potentially lead to unauthorized access or data exposure.
📂 Report JSON File: 3522157
@hackeronereports

🎯 New Report #3681690: ZMQ get output distribution duplicate amount DoS
🔺Severity: Medium
👽 Reporter: helping bro
⭐️ Reputation: 372
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-18
⏰ Disclosed: 2026-09-17 17:38:21
📝 Summary: The ZMQ get output distribution RPC was vulnerable to a memory exhaustion denial-of-service attack. The method accepted an unbounded amounts array and returned a separate distribution for each entry, allowing a small request to expand into a very large response by repeatedly including the amount 0. The issue was also reachable with --restricted-zmq-rpc because ZMQ lacked the stricter validation applied by restricted HTTP RPC. The vulnerability was resolved in https://github.com/monero-project/monero/pull/10419 and v0.18.5.0.
📂 Report JSON File: 3681690
@hackeronereports

🎯 New Report #3683886: Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks
🔺Severity: Medium
👽 Reporter: helping bro
⭐️ Reputation: 372
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-19
⏰ Disclosed: 2026-09-17 17:42:05
📝 Summary: The restricted ZMQ RPC in monerod did not enforce the same request restrictions as the restricted HTTP RPC. The ZMQ RPC relied primarily on a small method blocklist, allowing several allowed methods to accept requests that the restricted HTTP RPC explicitly rejected or capped. This issue was resolved in version 0.18.5.0.
📂 Report JSON File: 3683886
@hackeronereports