Loading HuntDB...

Show hide privacy giving receiving on my website

G
Gratipay
Submitted None
Reported by test99767

Vulnerability Details

Technical details and impact analysis

Privacy Violation
Hi team .. I found show hide privacy settings on website ... nobody can see on my profile but i put code on my website anybode can see my total giving .. Step reprodence .. 1- go to https://gratipay.com/~demo/settings/ click turn on ( hide total to giving other) and (hide my self from search result ) this way nobody can see my profile it . 2- go to https://gratipay.com/~demo/widgets/ 3- copy code to your website then preview your test site look show all your privacy before now you hide it * GIVING & TAKING WIDGETS Use this code to add a Gratipay "receiving" widget on your website: <script data-gratipay-username="demo" src="//grtp.co/v1.js"></script> Or, if you'd like to include a "giving" widget, you can add the data-gratipay-widget="giving" attribute: <script data-gratipay-username="demo" data-gratipay-widget="giving" src="//grtp.co/v1.js"></script> ##Poc Screenshot

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted

Weakness

Privacy Violation