A transparent, updated record of vulnerabilities discovered through Scan for Good, validated by Wiz Research, and responsibly remediated in partnership with affected organizations.
| # | Finding | Tokens | Class | Severity | Min | Cost |
|---|---|---|---|---|---|---|
| 1 | CI/CD secrets serialized into production JavaScript bundles | ~1.0M | Supply chain | Critical | 6.0 | ~$1.5 |
| 2 | Supply-chain RCE via JavaScript bundle to container-registry poisoning | ~400M | Supply chain | Critical | 18.0 | ~$100 |
| 3 | GraphQL authorization bypass on a service-management platform | ~1.0M | Broken access control | High | 14.0 | ~$1.5 |
| 4 | Subdomain takeover enabling session-cookie theft | ~1.0M | Subdomain takeover | High | 1.8 | ~$1.5 |
| 5 | Complete security-operations platform exposure affecting thousands of records | ~1.0M | Broken access control | Critical | 7.0 | ~$1.5 |
| 6 | Unauthenticated machine-token endpoint opening an enterprise operations platform | ~400M | Broken access control | Critical | 63.0 | ~$100 |
| 7 | Pre-authentication RCE through React Server Components deserialization | ~1.0M | RCE | Critical | 2.5 | ~$1.5 |
| 8 | Research-platform installer and full database-schema exposure | ~1.0M | Info disclosure | High | 8.0 | ~$1.5 |
| 9 | PHP type-juggling authentication bypass on a production ordering platform | ~1.0M | Auth bypass | Critical | 17.0 | ~$1.5 |
| 10 | Full-read SSRF reaching payment credentials and the internal network | ~400M | SSRF | Critical | 42.0 | ~$100 |
| 11 | Azure SSO bypass chained with SQL injection to obtain full administrator access | ~400M | SQL injection | Critical | 40.0 | ~$100 |
| 12 | Boolean-blind SQL injection used to extract database credentials | ~1.0M | SQL injection | Critical | 15.0 | ~$1.5 |
| 13 | Exposed .git directory containing production database credentials | ~1.0M | Info disclosure | Critical | 10.3 | ~$1.5 |
| 14 | Firebase Admin SDK key granting full project IAM access | ~1.0M | Secrets exposure | Critical | 11.5 | ~$1.5 |
| 15 | Admin API key granting write and delete access to millions of archived files | ~1.0M | Secrets exposure | Critical | 6.0 | ~$1.5 |
| 16 | Unauthenticated REST API exposing tens of thousands of personal records | ~1.0M | Broken access control | Critical | 9.0 | ~$1.5 |
| 17 | WordPress batch-route confusion leading from SQL injection to administrator credential extraction | ~1.0M | SQL injection | Critical | 20.0 | ~$1.5 |
| 18 | JWT validation declared but never enforced on a decision-support system | ~1.0M | Auth bypass | Critical | 5.0 | ~$1.5 |
| 19 | No authorization layer beneath the authentication gate on a physical access-control system | ~400M | Broken access control | Critical | 229 | ~$100 |
| 20 | A lead form sent applicant details to an unregistered API domain, allowing a new registrant to intercept sensitive submissions. | ~20.4M | Dangling domain | High | 18.7 | ~$8.59 |
| 21 | An admin CMS proxy treated a spoofable Origin header as authentication, exposing employee records and database schema without a login. | ~11.4M | Authentication bypass | High | 17.1 | ~$5.16 |
| 22 | A record-service gateway returned data for arbitrary object IDs without ownership checks, enabling bulk extraction of sensitive customer records. | ~45.2M | Broken access control | Critical | 20.0 | ~$24.36 |
| 23 | A production CMS allowed anonymous signup into a trusted role, giving new users access to the internal directory and durable write access to published content. | ~92.5M | Privilege escalation | High | 9.6 | ~$28.10 |
| 24 | A Laravel API route sat outside the authentication middleware, exposing a bulk database export and affiliate credentials without a login. | ~20.4M | Missing authentication | High | 18.7 | ~$8.59 |
| 25 | A record service returned names and addresses even when records carried a privacy flag intended to suppress them. | ~1.0M | Sensitive data exposure | High | 5.0 | ~$1.5 |
| 26 | A directory API exposed thousands of member and guardian records; masked list fields could be recovered through item lookups and query behavior. | ~1.0M | Sensitive data exposure | High | 5.0 | ~$1.5 |
| 27 | A safety-reporting API was hidden behind an admin-only interface but left its search and record routes unauthenticated, exposing personnel details. | ~1.0M | Missing authentication | High | 5.0 | ~$1.5 |
| 28 | A legacy project exporter ignored the OAuth check added to its replacement, exposing unpublished workbooks and researcher PII by numeric ID. | ~1.0M | Missing authentication | High | 5.0 | ~$1.5 |
| 29 | A document-download API converted pipe characters into paths but never canonicalized them, allowing anonymous traversal outside the intended directory. | ~1.0M | Path traversal | High | 5.0 | ~$1.5 |
| 30 | A configuration API omitted service authentication on three routes and returned its full RBAC directory of users and roles. | ~1.0M | Missing authentication | High | 5.0 | ~$1.5 |
| 31 | Two GIS services used for operational mapping allowed create, update, delete, upload, and sync actions without authentication. | ~1.0M | Broken access control | High | 5.0 | ~$1.5 |
| 32 | A membership portal relied on a browser widget for access control, while JSON, search, and direct-document routes remained open on the server. | ~1.0M | Client-side access control | High | 5.0 | ~$1.5 |
| 33 | A calendar export accepted query operators instead of a single event ID, allowing bulk download of meetings restricted to the member portal. | ~1.0M | Broken access control | High | 5.0 | ~$1.5 |
| 34 | An AI inference server protected only its versioned routes; root-level compatibility endpoints reached the same model without the required API key. | ~1.0M | Authentication bypass | High | 5.0 | ~$1.5 |
| 35 | An account-renewal route minted signed JWTs from sequential renewal IDs without a prior session, handing out tokens for other accounts. | ~1.0M | Authentication bypass | High | 5.0 | ~$1.5 |
| 36 | A case-search toolbar exposed restricted records through a convenience endpoint that skipped the role check enforced by the dedicated API. | ~1.0M | Broken access control | High | 5.0 | ~$1.5 |
| 37 | An attachment-download API streamed documents by sequential ID without checking record restrictions, exposing files the normal search intentionally hid. | ~1.0M | Broken access control | High | 5.0 | ~$1.5 |
| 38 | A dataset search concatenated user text into Solr, and a join query bypassed the isPublic filter to reveal unpublished packages. | ~1.0M | Query injection | High | 5.0 | ~$1.5 |
| 39 | A work-management GeoJSON route lacked the JWT middleware used by sibling routes, exposing internal work orders through saved filter IDs. | ~1.0M | Missing authentication | High | 5.0 | ~$1.5 |
| 40 | Three configuration routes skipped service authentication and returned user accounts, organizational contacts, role assignments, and GIS credentials. | ~1.0M | Missing authentication | High | 5.0 | ~$1.5 |
| 41 | A PDF proxy blocklisted hostnames but followed redirects, letting an attacker pivot the server into internal URLs and store the response as an externally readable file. | ~1.0M | SSRF | High | 5.0 | ~$1.5 |
| 42 | A service trusted a client-supplied origin and client code as authentication, exposing employee and customer accounts through anonymous lookup routes. | ~1.0M | Authentication bypass | High | 5.0 | ~$1.5 |
| 43 | A contact-directory API marked one route as skip-auth, exposing personnel records across tenants by iterating short organization codes. | ~1.0M | Missing authentication | High | 5.0 | ~$1.5 |
| 44 | A CMS still accepted the vendor's default OAuth client secret, issuing 30-day API tokens to anyone who knew the documented defaults. | ~1.0M | Weak credentials | High | 5.0 | ~$1.5 |
| 45 | A document route served files by numeric ID without checking the visibility flag or whether the related record had been published. | ~1.0M | Broken access control | High | 5.0 | ~$1.5 |
| 46 | A staff-directory service checked whether a page was readable but not whether it was a directory, exposing internal and cross-tenant employee profiles. | ~1.0M | Broken access control | High | 5.0 | ~$1.5 |
| 47 | A training-media embed API trusted only the Referer header and sequential video IDs, allowing restricted content to be enumerated and played off-site. | ~1.0M | Broken access control | High | 5.0 | ~$1.5 |
| 48 | A content site embedded a working GIS service username and password in page configuration sent to every anonymous visitor. | ~1.0M | Credential exposure | High | 5.0 | ~$1.5 |
| 49 | One asset-renewal controller was missing the authorization attribute used by every neighboring controller, exposing fleet inventory without a token. | ~1.0M | Missing authentication | High | 5.0 | ~$1.5 |
| 50 | A backend PDF route ignored the redaction checks in the main controller and generated unredacted disclosures containing protected personal information. | ~1.0M | Broken access control | Critical | 5.0 | ~$1.5 |
Showing 1–50 of 94 findings