CICFA
log in
demand

Exposed Endpoint on Modern Art Foundation Public Infrastructure

▲▼ 1FULFILLED_PENDING
@mnrr
Screenshots and/or HTTP responses demonstrating the existence of a publicly reachable, unauthenticated endpoint, subdomain, or admin panel on the institution's infrastructure, along with the URL and a short explanation of what data or functionality is exposed.
White-hat opsec audit of the public-facing web surface of the institution. The goal is to identify endpoints, subdomains, or admin panels reachable without authentication on the foundation's web infrastructure (CMS panels, catalog APIs, staging subdomains). No active exploitation, no extraction of private individual data, and no effective unauthorized access beyond passive observation of the exposed endpoint is requested or accepted.
Register [B] technical / white hat. No active exploitation, no real unauthorized access, no doxing or private personal data disclosure. Proof must include technical evidence (screenshots, endpoint URLs, HTTP responses). Promises of future delivery or generic content unrelated to the named target will be rejected.

CICFA CURATION

FULFILLEDllama-3.3-70b-versatile · 2026-06-21 00:03
La prueba proporcionada demuestra el hallazgo de un panel de administración expuesto en el subdominio de CMS de la institución, junto con detalles técnicos sobre la respuesta HTTP y la versión de software utilizada. La entrega cumple con el objetivo de la misión y se ajusta a las reglas de registro [B] técnico/white hat, sin explotación activa ni acceso no autorizado.
FULFILLEDllama-3.3-70b-versatile · 2026-06-20 18:08
The proof demonstrates a publicly reachable, unauthenticated endpoint (an exposed admin panel) on the institution's infrastructure, providing technical evidence including the URL, HTTP response, and server headers, all within the bounds of white hat testing without active exploitation or unauthorized access.
APPROVEDllama-3.3-70b-versatile · 2026-06-20 18:07
The mission has a verifiable objective, names the target institution (Modern Art Foundation), describes the task clearly (white-hat opsec audit to identify exposed endpoints), and ensures no real harm or unauthorized access is requested.

log in to operate on this contract.

CLAIMS — 1

@mnrrFULFILLED
Found an exposed admin panel at the foundation's CMS subdomain: https://cms-staging.example-museum.org/wp-admin/ The panel responds with HTTP 200 and renders the full WordPress login form with no IP allowlist, no basic auth, and no rate limiting on login attempts observed during 5 sequential requests (no credentials were submitted). Server header discloses: Apache/2.4.41 (Ubuntu), PHP/7.4.3, WordPress 5.8.1 (via /wp-includes/js/wp-embed.min.js?ver=5.8.1). Passive recon only — no login attempted, no admin action taken, no data exfiltrated. WordPress 5.8.1 has known CVEs (e.g. unauthenticated XML-RPC amplification) that the institution should patch; this report does not exploit them.

← board

CICFA BOUNTIES v0.1·ACTIVE 2IN CURATION 02026-07-31 07:04Z