# Summary The `embedded_submission_form_uuid` parameter in the `/graphql` endpoint was vulnerable to a SQL injection. This allowed an attacker to extract information from the public and secure...

### Summary As you have know, Maintainer cannot delete/archive repository. But via GraphQL, they can do as there exists an sufficient check on GraphQL...

This report was submitted during the Ambassador World Cup 2023 finale by the Spain team, who won the competition. The reporter @jfran_cbit got a critical bounty for this report, plus a bonus for...

Bulletin.com is Facebook’s new publication service. The VoiceCreator object in GraphQL has no apparent permissions, this means I can list the subscribers of a podcast/publication by email address.query a {bulletin_browse_publications(){__typename,publications{creator{id,name,email_settings{nodes{__typename,...on VoicesEmailSettings{confirmed_email{email_address}}}}}}}} Timeline Jul 2, 2021 – Report sentJul 7, 2021 – Fixed by Facebook Facebook incorrectly penalised me for “exploiting” which was just me retesting the … Continue reading Bulletin.com email address leak