How the Pwnedlist Got Pwned

Summary: A parameter-tampering flaw in pwnedlist.com let any user add arbitrary domains, email addresses, or password hashes to a watchlist without verification, and researcher Bob Hodges demonstrated it before Krebs replicated it by adding Apple.com and pulling a report of more than 100,000 plain-text usernames and passwords. InfoArmor, the Scottsdale company that ran the service, fixed the bug and announced Pwnedlist would be decommissioned on May 16, 2016, after Krebs showed a newly created free account could add gmail.com within 30 seconds.
Bottom line: The service held 866 million harvested credentials, and the same missing check meant any account could request a report covering that entire collection - a breach catalog that itself became a breach vector.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026