grep -r "password" . enthusiast.
Two stored XSS bugs in OpenClaw Dashboard, both the same missing encode on the way to innerHTML. One is reachable by an unauthenticated visitor through the login form, the other fires on a background timer with no admin click at all.
An unauthenticated visitor holding only a Password Pusher link could permanently destroy the secret behind it, even with deletable_by_viewer turned off, because the ownership check compared two nils and Ruby said they matched.
Three unauthenticated denial-of-service bugs in facil.io's hand-written HTTP and multipart parsers, all the same shape: a value that is correct where it is computed and wrong by the time someone uses it.
A select field with Ruby eval support and no sanitization becomes a remote code execution vector in Camaleon CMS, exploitable by any editor-level account.