This bug could allowed a malicious user to extract a large list of Facebook in-development apps along with their names,

Continue readingLeak of private/in-development app ids, names and translation requests

This bug could allowed a malicious user to expose internal paths of Facebook main server. The leaked paths were not

Continue readingInternal paths disclosure due to improper exception handling

The Ad-break program is designed for certain users to use it to add ads in videos posted in their pages.

Continue readingEnroll in Facebook Ad-break program without Facebook approval

This bug could allowed a malicious user with no role in a page to see if a page is eligible

Continue readingDisclose page violations and its eligibility to use Ad-breaks

This bug could have let an unprivileged attacker disclose the admins of a page and the payout account details, so

Continue readingDisclose page’s admins and its Monetization payout details

A malicious user with no permissions in a page can see its associated Instagram business account. The leaked data is

Continue readingDisclose Instagram business account linked to a Facebook page

This bug could have allowed an user with no role in a page to replace the page shop payment account

Continue readingChange payment account of any Facebook commerce page

This bug when exploited could allowed a malicious user to see business email and account balance of any shop page

Continue readingExpose business email and payment account balance of any Facebook commerce page.

This bug could allowed and attacker to bruteforce any Instagram account password without limiting his attempts. This issue occurs because

Continue readingBruteforce Instagram account’s passwords (lack of rate limiting protection).

This bug could be used by a malicious user to determine if a certain Facebook merchant page has pending or

Continue readingReveal if a Facebook merchant page has pending or completed orders.