web

A stored cross-site scripting vulnerability in Countly's feedback upload where the server trusted a client-supplied MIME type, serving attacker-controlled HTML from the application's origin and enabling full session compromise.

Abusing accounts tied to deactivated organisations to reach a hidden signup endpoint, bypassing an invite-only model to create arbitrary accounts and self-select privileged roles.

A mass assignment vulnerability in a healthcare onboarding flow where a single unvalidated ID field let an attacker control the primary key sequence and disable patient creation platform-wide.

A flaw in OAuth session token handling that allowed full account takeover with no user interaction.