Sai Praneeth Koti

KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint

Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library

SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile