Medium

Abhi Sharma

Pinned

In

InfoSec Write-ups

by

Abhi Sharma

·

Sep 5, 2025

How a Simple Race Condition Vulnerability Down a SaaS Global Platform

How a Simple Race Condition Vulnerability Down a SaaS Global Platform

Abhi Sharma

·

Jun 26

$1,100 Privilege Escalation: Group Leader Can Promote Anyone via Hidden Parameter

Hi Everyone! This one started as a simple permission check… but turned into a full role manipulation vulnerability inside a SaaS platform…

$1,100 Privilege Escalation: Group Leader Can Promote Anyone via Hidden Parameter

Abhi Sharma

·

Jun 19

$900 Session Flaw: Deprovisioned Users Retain Access After Permission Removal

Hi Everyone! Recently, while testing a SaaS platform (let’s call it ExampleCenter), I came across a very interesting access control issue…

$900 Session Flaw: Deprovisioned Users Retain Access After Permission Removal

Abhi Sharma

·

Jun 12

$750 Authorization Bypass: Enumerating Calendar Forms via Group Type ID

Hi Everyone! Sometimes the most interesting bugs are not about direct access… but about connecting two features that were never meant to…

$750 Authorization Bypass: Enumerating Calendar Forms via Group Type ID

Abhi Sharma

·

Jun 5

$600 BOLA: Breaking Event Boundaries Using Cross-Selection Injection

Hi Everyone! Sometimes bugs don’t look dangerous at first… until you understand what they break behind the scenes.

$600 BOLA: Breaking Event Boundaries Using Cross-Selection Injection

Abhi Sharma

·

May 29

$575 CSRF: Triggering Payment Receipt Emails Without User Consent

Hi Everyone! This write is about a Cross-Site Request Forgery (CSRF) vulnerability in the payment flow that allowed an attacker to trigger…

$575 CSRF: Triggering Payment Receipt Emails Without User Consent

Abhi Sharma

·

May 22

$850 Authorization Bypass: Viewer Accessing Automations & Webhook Data via API

Hi Everyone! While testing a SaaS platform (ExampleCenter), I discovered an authorization bypass vulnerability that allowed a…

$850 Authorization Bypass: Viewer Accessing Automations & Webhook Data via API

Abhi Sharma

·

May 15

$900 IDOR: Unauthorized Access to Form Attachments via Direct API

Hi Everyone! While testing a SaaS platform (ExampleCenter), I discovered an authorization bypass vulnerability that allowed a…

$900 IDOR: Unauthorized Access to Form Attachments via Direct API

Abhi Sharma

·

May 8

$1,150 Logic Bug: Orphaning Workflow Cards via Invalid User Assignment

Hi Everyone! While testing a SaaS platform (ExampleCenter), I found a very interesting bug that at first looked like a normal workflow…

$1,150 Logic Bug: Orphaning Workflow Cards via Invalid User Assignment

Abhi Sharma

·

May 1

$2,150 Critical Authorization Bypass: Viewer to Admin Privilege Escalation via API

Hi Everyone! While testing a SaaS platform (let’s call it ExampleCenter), I discovered a critical Broken Access Control vulnerability that…

$2,150 Critical Authorization Bypass: Viewer to Admin Privilege Escalation via API

Abhi Sharma

Abhi Sharma

Cybersecurity Consultant | Pentester | Bug Bounty Hunter | ContentWriter 🔗 Connect with me on https://twitter.com/a13h1_ and https://www.linkedin.com/in/a13h1/

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech