Skip to content
BackEsc
Sign in

Ferrero · in scope

Web applications

388 assets in scope

Every dot is an asset the program lists in scope. The first 20 are named here; the program's own page has the full scope.

Open Ferrero on HackerOne

Every one of the 388 is a mark on the map. Named now: 1 to 20, as listed first.

  1. backtoschool2024.ferreropromo.itWeb applications
  2. caraffa2024.ferreropromo.itWeb applications
  3. figurine2024.ferreropromo.itWeb applications
  4. fulfil-promo.deWeb applications
  5. ge63-ferreropp.web.oxv.frWeb applications
  6. http://backtoschool25.ruWeb applications
  7. http://duplo-chocnut.de/gratistestenWeb applications
  8. http://estathe.it/Web applications
  9. http://fandom.kinder.com/strangerthingsWeb applications
  10. http://kinder.com/de/de/xp/magische-bescherungWeb applications
  11. http://kinderkarnawal.pl/admin_bn5cz9k4/loginWeb applications
  12. http://quality-ksb-onepiecenetflix-de-2026.ipaasferrero.com/de/de/xp/ksb-onepiecenetflixWeb applications
  13. http://quality-songsmitherz-de-2026.ipaasferrero.com/de/de/xp/songsmitherzWeb applications
  14. http://testy.kinderdziendziecka.plWeb applications
  15. http://testy.kinderdziendziecka.pl/admin_dakr82swpWeb applications
  16. http://www.eatnatural.com/de/de/xp/gratistesten/Web applications
  17. http://www.ferrero-cashback.deWeb applications
  18. http://www.k-joy.de/strangerthingsWeb applications
  19. http://www.kinder.com/de/de/xp/ksb-onepiecenetflixWeb applications
  20. http://www.kindercreamypromo.com/in/en/xp/freegiftwitheverypackWeb applications

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in