Our Fuel Card Portal Read Its Sign In Code to a Voicemail Anyone Could Dial Into
Our lorries and vans fill up on fuel cards, about four hundred of them, managed through the card company's online portal. Three people in our transport office use it. The portal can block a card, change a limit, order replacements and set the address they are posted to. It has a second step at sign in. You choose whether the code is sent by text or read out in a phone call, and the number registered for our account was the transport office landline, because that was the number on the original ap
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.