← back to the grid
webmedium

Insecure Direct Object Reference

HEMLEM HR Portal uses sequential integer IDs in the API path. The backend authenticates who you are. It does not verify that you're authorized to access the record you're requesting.

sandbox · allow-scripts · no-same-origin · null-origin● live

practice grid — every target is a toy in your own browser. this is not an invitation to test the real site.

enter flag