Rockstar Games · disclosed reports
Cross-site Scripting
33 disclosed reports · $9,900 paid · 33 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Rockstar Games on HackerOne- reports
- 33
- valid
- 33
- paid a bounty
- 11
Every one of the 33 is a mark on the map. Named now: 1 to 26, most upvoted first.
- The return of the ＜
- XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker)
- xss on https://www.rockstargames.com/GTAOnline/jp/screens/
- Stored XSS in Snapmatic + R★Editor comments
- XSS on rockstargames.com
- Stored XSS on support.rockstargames.com
- DOM XSS on https://www.rockstargames.com/GTAOnline/feedback
- DOM based XSS on /GTAOnline/tw/starterpack/
- Stored XSS in profile activity feed messages
- Stored XSS on profile page via Steam display name
- DOM Based xss on https://www.rockstargames.com/ ( 1 )
- stored XSS (angular injection) in support.rockstargames.com using zendesk register form via name parameter
- Stored XSS in snapmatic comments
- XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.js
- DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax request
- Reflected XSS in /Videos/ via calling a callback http://www.rockstargames.com/videos/#/?lb=
- Reflected XSS via #tags= while using a callback in newswire http://www.rockstargames.com/newswire
- Stored XSS on member post feed
- Reflected XSS via Double Encoding
- [IMP] - Blind XSS in the admin panel for reviewing comments
- Stored XSS with CRLF injection via post message to user feed
- Stored XSS via Send crew invite
- Dom based xss on https://www.rockstargames.com/ via `returnUrl` parameter
- Reflected XSS in reddeadredemption Site located at www.rockstargames.com/reddeadredemption
- Dom based xss on /reddeadredemption2/br/videos
- Warehouse dom based xss may lead to Social Club Account Taker Over.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.