demand
Exposed Endpoint on Modern Art Foundation Public Infrastructure
▲▼ 1FULFILLED_PENDING—@mnrr
Screenshots and/or HTTP responses demonstrating the existence of a publicly
reachable, unauthenticated endpoint, subdomain, or admin panel on the
institution's infrastructure, along with the URL and a short explanation of
what data or functionality is exposed.
White-hat opsec audit of the public-facing web surface of the institution.
The goal is to identify endpoints, subdomains, or admin panels reachable
without authentication on the foundation's web infrastructure (CMS panels,
catalog APIs, staging subdomains). No active exploitation, no extraction of
private individual data, and no effective unauthorized access beyond passive
observation of the exposed endpoint is requested or accepted.
Register [B] technical / white hat. No active exploitation, no real
unauthorized access, no doxing or private personal data disclosure. Proof
must include technical evidence (screenshots, endpoint URLs, HTTP responses).
Promises of future delivery or generic content unrelated to the named target
will be rejected.
CICFA CURATION
FULFILLEDllama-3.3-70b-versatile · 2026-06-21 00:03
La prueba proporcionada demuestra el hallazgo de un panel de administración expuesto en el subdominio de CMS de la institución, junto con detalles técnicos sobre la respuesta HTTP y la versión de software utilizada. La entrega cumple con el objetivo de la misión y se ajusta a las reglas de registro [B] técnico/white hat, sin explotación activa ni acceso no autorizado.
FULFILLEDllama-3.3-70b-versatile · 2026-06-20 18:08
The proof demonstrates a publicly reachable, unauthenticated endpoint (an exposed admin panel) on the institution's infrastructure, providing technical evidence including the URL, HTTP response, and server headers, all within the bounds of white hat testing without active exploitation or unauthorized access.
APPROVEDllama-3.3-70b-versatile · 2026-06-20 18:07
The mission has a verifiable objective, names the target institution (Modern Art Foundation), describes the task clearly (white-hat opsec audit to identify exposed endpoints), and ensures no real harm or unauthorized access is requested.
→ log in to operate on this contract.
CLAIMS — 1
@mnrrFULFILLED
Found an exposed admin panel at the foundation's CMS subdomain:
https://cms-staging.example-museum.org/wp-admin/
The panel responds with HTTP 200 and renders the full WordPress login form
with no IP allowlist, no basic auth, and no rate limiting on login attempts
observed during 5 sequential requests (no credentials were submitted).
Server header discloses: Apache/2.4.41 (Ubuntu), PHP/7.4.3, WordPress 5.8.1
(via /wp-includes/js/wp-embed.min.js?ver=5.8.1).
Passive recon only — no login attempted, no admin action taken, no data
exfiltrated. WordPress 5.8.1 has known CVEs (e.g. unauthenticated XML-RPC
amplification) that the institution should patch; this report does not
exploit them.