Algolia Program Statistics

View program

34 total issues disclosed

$6,000 total paid publicly

Most disclosed (10 disclosures) — Cross-site Scripting (XSS) - Generic

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
Web Cache Deception vulnerability on algolia.com leads to personal information leakage Violation of Secure Design Principles golim Medium 2023-04-19
Information disclosure -> 2fa bypass -> POST exploitation Information Disclosure akashhamal0x01 Medium 2021-09-08
PHP-FPM status page disclosure Information Disclosure iamthefrogy Low 2021-05-10
Information disclosure via a misconfigured third-party product Information Disclosure h4x0r_dz High 2021-03-03
email verification bypass Improper Authentication - Generic akashhamal0x01 Medium 2021-02-18
subdomain take over at recommendation.algolia.com Violation of Secure Design Principles badcracker Medium 2019-08-14
Web Cache Deception Attack (XSS) Cross-site Scripting (XSS) - Reflected testingforbugs Medium 2019-03-22
Directory traversal at https://msg.algolia.com Path Traversal n00bsec Medium 2018-06-09
Text injection on status.algolia.com Violation of Secure Design Principles sh3r1 Low 2017-08-25
SAUCE Access_key and User_name leaked in Travis CI build logs Information Disclosure an0n-j Medium 2017-07-12
An “algobot”-s GitHub access token was leaked Information Disclosure sainaen Medium 2017-06-10
[GitHub Extension] Unsanitised HTML leading to XSS on GitHub.com Cross-site Scripting (XSS) - DOM ysx High 2017-04-24
[github.algolia.com] DOM Based XSS github-btn.html Cross-site Scripting (XSS) - Generic bobrov Medium 2017-03-31
No rate limit for Referral Program Violation of Secure Design Principles madxcmg No rating 2017-03-12
Reflected XSS Cross-site Scripting (XSS) - Generic no_thing No rating 2017-02-11
2-factor authentication bypass Improper Authentication - Generic malcolmx No rating 2017-01-17
Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed. Improper Authentication - Generic eboda No rating 2016-11-27
Possilbe Sub Domain takever at prestashop.algolia.com None supplied punkrock No rating 2016-11-04
Hyperlink Injection in Friend Invitation Emails Open Redirect corb3nik No rating 2016-10-07
RCE on facebooksearch.algolia.com Code Injection michiel No rating 2016-10-01
Stored xss Cross-site Scripting (XSS) - Generic rishi62 No rating 2016-09-07
Stored XSS from Display Settings triggered on Save and viewing realtime search demo Cross-site Scripting (XSS) - Generic ctee No rating 2016-09-07
Stored XSS triggered by json key during UI generation Cross-site Scripting (XSS) - Generic ctee No rating 2016-09-07
No Rate Limit In Inviting Similar Contact Multiple Times Cryptographic Issues - Generic rajauzairabdullah No rating 2016-09-07
[github.algolia.com] XSS Cross-site Scripting (XSS) - Generic bogdantcaciuc No rating 2016-09-01
Stored xss Cross-site Scripting (XSS) - Generic sysecure No rating 2016-08-03
Stored XSS in name selection Cross-site Scripting (XSS) - Generic dly No rating 2016-06-18
User with limited access to Index configuration can rename the Index Improper Authentication - Generic bugs3ra No rating 2016-06-01
No rate-limit in Two factor Authentication leads to bypass using bruteforce attack Improper Authentication - Generic bugs3ra No rating 2016-06-01
API Key added for one Indices works for all other indices too. Improper Authentication - Generic bugs3ra No rating 2016-06-01
PHP version disclosed on blog.algolia.com Information Disclosure bugs3ra No rating 2016-06-01
an xss issue Cross-site Scripting (XSS) - Generic boniao_norwin No rating 2016-05-22
text injection can be used in phishing 404 page should not include attacker text Violation of Secure Design Principles djamel-ghorab No rating 2016-05-09
Stored XSS on https://www.algolia.com/realtime-search-demo/* Cross-site Scripting (XSS) - Generic stefanofinding No rating 2016-02-03