Loading story…
A security researcher disclosed multiple vulnerabilities in Yahoo's Small Business/Luminate platform that allowed access to sensitive customer and internal infrastructure data. In one case, a directory traversal flaw across invoice, subscription, order, and payment-related endpoints let an attacker browse files in user-specific directories by abusing ../ path sequences and predictable account identifiers derived from a victim's email address. By chaining that weakness with a cart modification endpoint that leaked a payment token after brute-forcing a guessable subscription number, the researcher said an attacker with only an email address could retrieve billing details including the last four digits of a credit card, expiration month, and billing address.
In a separate finding on the same platform, the researcher exploited a server-side request forgery in a screenshot feature after discovering an exposed config.json file that referenced a Yahoo proxy to internal domains. The flaw enabled enumeration of internal hosts tied to Chef, Docker, AWS-related systems, Graylog, and MongoDB, and was combined with an XSS issue in the site editor to force the screenshot service to fetch attacker-controlled URLs, including the AWS metadata address 169.254.169.254. The researcher reported the issues to Yahoo, said testing stopped after impact was confirmed, and noted that Yahoo remediated the SSRF and XSS in August 2017 and the directory traversal chain in November 2017.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Yahoo remediated the directory traversal vulnerability chain affecting invoice, subscription, order, and payment-method related functionality on its Small Business platform.
Yahoo acknowledged and triaged the directory traversal and billing-data exposure report two days after it was submitted.
A security researcher disclosed a directory traversal vulnerability chain in Yahoo's Small Business platform on luminate.com that exposed customer billing and payment-related information. By combining traversal flaws with a cart modification endpoint and guessable subscription numbers, an attacker with a victim's email address could access payment method details such as last four digits, expiration month, and billing address.
Yahoo fixed the related XSS issue in the site editor that had been used to help exploit the SSRF path.
Yahoo remediated the SSRF issue in the Small Business/Luminate platform's screenshot-related functionality.
Yahoo acknowledged and triaged the reported SSRF and XSS vulnerabilities on the same day they were submitted.
A security researcher identified an SSRF vulnerability in Yahoo's Small Business/Luminate platform, chained with an XSS issue in the site editor, that enabled requests to internal services including AWS metadata and other internal hosts. The researcher reported the issue to Yahoo and stopped further testing after confirming the impact.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
samcurry.net
Open sourcesamcurry.net
Open sourceseanmelia.files.wordpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dark web monitoring reports surfaced multiple **alleged data leaks** affecting unrelated organizations, with several listings offering databases for sale or direct download. Reports claim **Republic (republic.com)** user data (~4.94M users) was listed for sale for **$2,400**, allegedly including names, emails, physical addresses, and phone numbers. Separate dark web listings also alleged exposure of **rueducommerce.fr** user data (linked in reporting to **Carrefour**) totaling ~2.17M records with similar PII, as well as alleged leaks involving **Dunzo** (~3.4M records) and **Menulux** (~93K records). Additional reporting highlighted a historical breach dataset for the **YouHack** forum (2013; ~107K users) containing usernames, emails, passwords, IPs, posts, and private messages, and a smaller exposure tied to **buylottoonline.com** (~38.5K email records). One of the most consequential claims involved **Salesfloor / People Powered E-Commerce (salesfloor.net)**, attributed in reporting to **LAPSUS$**, alleging theft of roughly **4 TB uncompressed** (1 TB compressed) data including **source code, logs, and customer information**, with potential downstream impact to retail brands using the platform. Separately from the dark-web-leak theme, other items in the set describe distinct vulnerability-driven risks rather than breach listings: **Zoom Node MMRs** command injection (**CVE-2026-22844**, CVSS 9.9) enabling arbitrary code execution in certain hybrid meeting deployments; **SmarterMail** auth bypass (**CVE-2026-23760**) enabling admin password reset via `force-reset-password` and potential RCE; **Vite** improper access control (**CVE-2025-31125**) enabling sensitive file exposure via query parameters such as `?inline&import` / `?raw&import` (noted as added to CISA KEV); and **Appsmith** password-reset token exposure (**CVE-2026-22794**) enabling account takeover, with internet-exposed instances identified via Shodan and remediation via upgrade to *Appsmith* 1.93. These vulnerability reports are separate from the dark web leak claims and should be tracked as independent patching priorities rather than as part of a single breach event.
Jun 29, 2026
**Bluspark Global**, a New York-based shipping technology provider, remediated multiple critical security weaknesses in its *Bluvoyix* shipping and supply-chain platform after a researcher found the system was effectively exposed to the public internet and could have enabled unauthorized access to sensitive customer data. The issues risked exposing decades of shipment records for hundreds of large companies that use the platform across sectors such as retail, grocery, and manufacturing, and could have allowed remote interaction with Bluvoyix’s shipping software. Security researcher **Eaton Zveare** reported finding **five** flaws, including the use of **plaintext passwords** and an **unauthenticated API** that could allow retrieval of user account records (including administrator credentials) and creation of new administrative accounts without authentication. Reporting indicated that disclosure was complicated by the lack of a clear security contact or bug reporting channel; Bluspark said the issues have been resolved and it plans to implement a formal **bug disclosure program**.
Jun 29, 2026
Yahoo disclosed two massive intrusions that together affected more than **1.5 billion user accounts**, including a 2014 breach impacting at least **500 million accounts** and a separate 2013 breach affecting more than **1 billion accounts**. Reporting said the company detected signs of the 2014 intrusion well before its public disclosure but did not fully understand the scope until a later review in 2016, while investigators also examined evidence that attackers may have accessed some accounts without passwords by using forged cookies and stolen proprietary code. Yahoo attributed the 2014 attack to a state-backed actor, and later U.S. authorities described a Russian-linked operation that stole account data and internal secrets tied to the campaign.
Jun 29, 2026