Liberapay Program Statistics

View program

50 total issues disclosed

$250 total paid publicly

Most disclosed (6 disclosures) — Business Logic Errors

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat None supplied its9me Medium 2026-08-01
another liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link Open Redirect rox-11 None 2026-05-09
Liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link Open Redirect rox-11 No rating 2026-05-09
Unsafe yaml load can lead to remote code execution Deserialization of Untrusted Data tarun_sec Low 2024-05-04
Avatar URL is exposed in patron export for secret donations Privacy Violation mdivecky Medium 2023-12-15
Password Reset Token Leak Via Referrer Information Disclosure 0xthem7 Medium 2023-11-23
Twitter account hijack @Costalfy Phishing mwhx-404 Low 2023-09-27
Disavowed an email without any authentication Improper Access Control - Generic hunterr0x01 Medium 2023-07-31
Email Address Exposure via Gratipay Migration Tool Insecure Direct Object Reference (IDOR) suprnova Medium 2022-10-09
Disavowing an account doesn't disable it Improper Authentication - Generic raven_in_matrix Low 2021-05-07
Login CSRF : Login Authentication Flaw on https://liberapay.com/ Phishing samjoy_26 Low 2021-04-05
Failure to Invalid Session after Password Change Violation of Secure Design Principles sudipraj Low 2021-03-12
Reauthentication for changing password bypass Improper Authentication - Generic viber Low 2020-12-23
Leaking Of Sensitive Information on Github Information Disclosure harrisoft Low 2020-04-03
Private target account appears in search results Privacy Violation magic_spell None 2019-11-06
Invalidate session after password reset Violation of Secure Design Principles nikhil786 Low 2019-11-05
Full Path disclosure on 500 error Information Disclosure rajauzairabdullah Low 2019-10-05
Session Cookie without HttpOnly and secure flag set Violation of Secure Design Principles doug18 None 2019-02-21
User Enumeration None supplied htrgouvea Low 2019-01-05
Publicly editable GitHub wikis Improper Access Control - Generic strukt High 2018-12-12
Import of repositories from GitHub is tied to username instead of immutable ID Improper Access Control - Generic emitrani Low 2018-12-02
Broken Authentication and session management OWASP A2 Improper Authentication - Generic sameerphad72 None 2018-11-26
Improper Data Validation / Unvalidated Input Classic Buffer Overflow cardangi None 2018-07-05
No Data Validation, No Captcha, No Filters... Business Logic Errors cardangi None 2018-06-11
Cross site scripting (content-sniffing) Cross-site Scripting (XSS) - DOM said778 None 2018-06-10
Buffer overflow Classic Buffer Overflow kaushalag29 None 2018-06-10
Punny code Detection Parsing should be implemented on Markdown Business Logic Errors kunal94 None 2018-06-07
Returning back from the browser after logging off will disclose some information Business Logic Errors zir0x No rating 2018-06-07
A single user can subscribe a community multiple times Business Logic Errors mks11nov None 2018-06-07
Exploiting JSONP callback on /username/charts.json endpoint leads to information disclosure despite user's privacy settings Information Disclosure kapytein Medium 2018-06-05
Missing back-end user input validation can lead to DOS flaw Business Logic Errors zuh4n No rating 2018-06-05
Csrf token does not meet security design None supplied wsfengfan474 No rating 2018-06-05
REGISTRATION USING FAKE EMAIL ACCOUNT Business Logic Errors rootbakar None 2018-06-05
Unsafe deserialization in Libera Pay allows to escalate a SQL injection to Remote Command Execution Deserialization of Untrusted Data kapytein No rating 2018-06-04
CSRF token manipulation in every possible form submits. NO server side Validation Cross-Site Request Forgery (CSRF) mah1ndra No rating 2018-06-04
csrf token did not changed after login/logout many times Cross-Site Request Forgery (CSRF) cryptographer None 2018-06-04
Current CSP Policy chained with HTML Injection can lead to Data Exfiltration Violation of Secure Design Principles nthack None 2018-06-04
Phishing by Navigating Browser Tabs None supplied 4w3 None 2018-06-04
CSRF ON EDITING NAME (OPTIONAL) Cross-Site Request Forgery (CSRF) rootbakar None 2018-06-04
Insecure Account Deletion Improper Authentication - Generic hack2684 None 2018-06-04
The csrf token remains same after user logs in Violation of Secure Design Principles d4w No rating 2018-06-04
Same CSRF token is being used for deleting other platform login’s within an account and across other liberapay Account’s Cross-Site Request Forgery (CSRF) mah1ndra No rating 2018-06-04
Anyone can register organization legal type as "Soletrader" Resource Injection 4bg0p None 2018-06-03
Liberapay Non Verified Account Takeover with signup feature Improper Authentication - Generic babayaga_ None 2018-06-03
Unsecure changing password None supplied asdfasdfasdfasdfasdfsdfsdfsdf None 2018-06-02
twitter api access token leaked on github Cleartext Storage of Sensitive Information sonahri_501 None 2018-06-02
Authenticated reflected XSS on liberapay.com via the back_to parameter when leaving a team. Cross-site Scripting (XSS) - Reflected techguynoob Low 2018-06-02
CSRF to make any user accept the invitation to the team Cross-Site Request Forgery (CSRF) albatraoz None 2018-06-02
Origin IP found, Cloudflare bypassed Improper Access Control - Generic europa Medium 2018-06-02
Able to View other users income history Insecure Direct Object Reference (IDOR) amaljacob None 2018-06-02