Tools for Humanity

Tools for Humanity 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 业务逻辑2
• 不安全的直接对象引用1
• 跨站脚本1

主要弱点

• 业务逻辑错误1
• Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1
• Cross-Site Scripting (XSS)1
• IDOR1

常见资产

• *.worldcoin.orgWILDCARD · 3
• https://apps.apple.com/no/app/world-app-worldcoin-wallet/id1560859847APPLE_STORE_APP_ID · 1

高票报告

当前状态 4 份 · 全部 4

1. 106
   [Meetup][World ID][OIDC] Insufficient Filtering of "state" Parameter in Response Mode form_post leads to XSS and ATO跨站脚本 · 2024-06-19 · 严重
   $0Cross-Site Scripting (XSS)
2. 95
   Race Condition Enables Bypassing Verification Check业务逻辑 · 2024-04-05 · 高危
   $3,000Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
3. 91
   IDOR - Leaking of team data (name, email, ID, member ID) via POST /api/v1/graphql `FetchMemberships` operation不安全的直接对象引用 · 2024-05-10 · 中危
   $500IDOR
4. 66
   Unlock underage blocked app without support interaction using airplane mode业务逻辑 · 2025-06-30 · 低危
   $300业务逻辑错误