P4 Bugs and PoC | Part 3

👋 Hi everyone!
I’m Abhijeet Kumawat, a passionate bug bounty hunter and security researcher. I love sharing my experiences and insights in bug bounty hunting and penetration testing. Today, I’m thrilled to continue my P4 Bug Series — where I uncover some low-severity vulnerabilities that are often overlooked but can provide significant learning and even impactful results when exploited.

In this post, I’ll cover two interesting P4 vulnerabilities: Content Spoofing and Failure to Invalidate Session on Password Reset/Change. Both of these bugs are relatively simple to understand and exploit, making them perfect for beginner bug hunters or those looking to sharpen their skills. 🚀

Description:
Content Spoofing allows attackers to manipulate how content appears on a webpage, misleading users by displaying fake messages or misleading information under the guise of a trusted domain. This vulnerability is often exploited in social engineering attacks, where users are tricked into taking unintended actions, such as entering…