Samuel
@samuel.fm
haha how did I miss the other ones
1 1David BuchananWell it just depends on how you count lol. The first one was XSS, but nobody was exploiting it, it was just a "hey you should fix it".
The second was the auth bypass that I rather cheekily exploited as a PoC to post from the official twexit account, but nothing beyond that.
3 4Samueldidn't see that second one lol
1David BuchananIt was what I was quoting here, although sadly it was since deleted bsky.app/profile/retr...
David Buchanan@retr0.id· 10 Oct 2023just to be clear - this post was made by me. that's the bug. I can post as anyone with an active twexit login session. (or uh, read their DMs, if I were so inclined)
David BuchananAnd the third was an SQL injection vuln which I reported privately around the same time as the second one (it was related to it), but I'm not sure I ever mentioned that one publicly.
2 4