Skip to content

Pull requests: COG-GTM/juice-shop

New pull request New
45 Open 0 Closed
45 Open 0 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

bug: fix path traversal in key, logfile and quarantine file servers
#45 opened Jul 29, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: fix stored XSS in admin panel via feedback comment
#44 opened Jul 28, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
2
bug: fix SQL injection in login route via bind parameters
#43 opened Jul 28, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: fix reflected XSS in order tracking result (track-result)
#42 opened Jul 24, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
2
bug: fix NoSQL/SSJS injection in track-order route
#41 opened Jul 24, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
2
bug: fix NoSQL injection in /rest/track-order/:id via equality query
#40 opened Jul 22, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: remove hardcoded RSA private key used to sign auth JWTs
#39 opened Jul 13, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
10
bug: fix SQL injection in /rest/user/login via parameterized query
#38 opened Jul 12, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
8
bug: prevent XXE in XML file upload by disabling external entity expansion
#37 opened Jul 9, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: fix Zip Slip in ZIP complaint upload (routes/fileUpload.ts)
#36 opened Jul 9, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: enforce authorization on PUT /api/Products/:id
#35 opened Jul 8, 2026 by devin-ai-integration Bot Loading…
2 tasks done
1
bug: prevent privilege escalation via role in POST /api/Users
#34 opened Jul 8, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: fix reset-password rate-limit bypass via X-Forwarded-For spoofing
#33 opened Jul 8, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: upgrade multer to ^2.2.0 to fix critical + high security vulnerabilities
#32 opened Jul 8, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: fix stored XSS in product descriptions (restfulXssChallenge)
#31 opened Jul 7, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
@schaudhry123
10
bug: fix SQL injection in product search via parameterized query
#30 opened Jul 7, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: fix unvalidated SSRF in profileImageUrlUpload
#29 opened Jul 7, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: fix unauthenticated SQL injection in product search
#28 opened Jul 7, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: restrict /rest/memories user join to username only
#27 opened Jul 6, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
fix(security): remove SSTI-to-RCE via eval of username in user profile
#26 opened Jul 3, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
@tobydrinkall
1
bug: externalize hardcoded JWT RSA signing key
#25 opened Jul 3, 2026 by devin-ai-integration Bot Loading…
2 tasks done
1
bug: prevent /rest/memories from leaking sensitive user fields
#24 opened Jul 2, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
@tobydrinkall
1
bug: fix mass-assignment privilege escalation on POST /api/Users
#23 opened Jul 1, 2026 by devin-ai-integration Bot Loading…
2 tasks done
@Pvpres
1
bug: load JWT keys from runtime
#22 opened Jul 1, 2026 by devin-ai-integration Bot Loading…
2 of 3 tasks
1
bug: upgrade multer to ^2.2.0 to fix 1 critical + 7 high CVEs
#21 opened Jul 1, 2026 by devin-ai-integration Bot Loading…
2 tasks done
1
ProTip! Exclude everything labeled bug with -label:bug.