Search across all content
Sequential or guessable IDs make it trivial to enumerate all user accounts and scrape user profiles — a common IDOR (Insecure Direct Object Reference) risk.
1. Go to leaderboards 2. It exposes predictable user IDs in the URL
Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Device: MacIntel | 1920x1080
Please sign in to leave a comment
7 days ago
7 days ago