Pull requests: COG-GTM/juice-shop
Pull requests list
Fix: Missing ownership check on PUT /api/Addresss/:id allows modifying other users' saved addresses
#366
opened Sep 14, 2026 by
WesternConcrete
Loading…
2 of 3 tasks
Fix: Unauthenticated access to customer order confirmation PDFs via /ftp
#365
opened Sep 14, 2026 by
WesternConcrete
Loading…
2 of 3 tasks
Fix: Server-side template injection: GET /profile passes the user-controlled username to eval(), enabling remote code execution
#363
opened Sep 13, 2026 by
WesternConcrete
Loading…
2 of 3 tasks
Fix: Forgeable discount coupons: unsigned z85-encoded coupon codes accepted by PUT /rest/basket/:id/coupon/:coupon allow arbitrary discounts up to 99%
#361
opened Sep 12, 2026 by
WesternConcrete
Loading…
2 of 3 tasks
Fix: Server-side evaluation of user-supplied orderLinesData in POST /b2b/v2/orders enables CPU-exhaustion denial of service and sandbox-escape code execution
#359
opened Sep 11, 2026 by
WesternConcrete
Loading…
2 of 3 tasks
Fix: SQL injection in GET /rest/products/search via string-interpolated q parameter allows UNION extraction of the Users table
#358
opened Sep 11, 2026 by
WesternConcrete
Loading…
2 of 3 tasks
Fix type confusion in product search query parameter (CWE-843)
#356
opened Sep 10, 2026 by
matthewguerra-cog
Loading…
2 of 3 tasks
bug: parameterize login query to fix SQL injection (routes/login.ts)
#354
opened Sep 10, 2026 by
matthewguerra-cog
Loading…
2 of 3 tasks
Fix SQL injection in product search (routes/search.ts)
#353
opened Sep 10, 2026 by
matthewguerra-cog
Loading…
2 of 3 tasks
Add rate limiting to /rest/user/login (js/missing-rate-limiting)
#352
opened Sep 10, 2026 by
matthewguerra-cog
Loading…
2 of 3 tasks
ProTip!
Type g p on any issue or pull request to go back to the pull request listing page.