writeups.xyz writeups.xyz

InfoSec and Bug Bounty Writeups Directory.

This Website is a collection of Information Security and Bug Bounty writeups that allows you to easily filter writeups by vulnerabilities, programs, authors, and more, making your research and exploration of security issues simpler and more efficient.

Important Note: Please remember that the inclusion of a program or target in this directory does not imply permission to conduct any hacking activities. Always review and adhere to the specific policies of each program before taking any action.

Title Vulnerabilities Programs Authors
Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail
Unveiling Remote Code Execution in AI chatbot workflows 💵
How I Earned $469 Bounty: Bypassing Plan Restriction
How I Got Critical P2 Bug on Google VRP
No Database No Table, how do you do MSSQL Injection?
Auditing Atlassian Plugins, 53 0-Days Later
Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit
KnowBe4 RCE and LPE
Account Takeover via Broken Authentication Workflow: Free Lifetime Streaming!
Pwn2Own Miami: Aveva Edge Arbitrary DLL Loading Vulnerability
SAML Authentication Bypass Leading to Admin Panel Access
Credential Disclosure in LastPass
Escalating Privileges in Google Cloud via Open Groups
Plug Security Holes in React Apps That Can Lead to API Exploitation
Teaching the Old .NET Remoting New Exploitation Tricks
CVE-2023-42929: Why do we need the App Container Protection
Interesting Business Logic Error leads to Pre-Account Takeover via Verification bypass on GoogleVRP
MITMing the Xbox 360 Dashboard for Fun and RCE
Stealing First Party Access Token of Facebook Users: Meta Bug Bounty
A Creative Way To Get Someones YouTube Videos Deleted + A Copyright Strike Against Their YouTube Channel
Bypass Plan Restriction & Get 350$ Bounty
Drop the Mic (CVE-2019-1166)
Oracle Retail Xstore Suite: Pre-authenticated Path Traversal
Over 1 Million websites are at risk of sensitive information leakage - XSS is dead. Long live XSS
Unlocking the Weak Spot: Exploiting Insecure Password Reset Tokens