Skip to content
BackEsc
Sign in

Slack · disclosed reports

Cross-site Scripting

32 disclosed reports · $10,225 paid

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

Open Slack on HackerOne
reports
32
paid a bounty
12

Every one of the 32 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. XSS vulnerable parameter in a location hash#146336Slack · 455 votes
  2. XSS in gist integration#11073Slack · $500 · 157 votes
  3. Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs#132104Slack · 103 votes
  4. Stored XSS through PDF viewer#881557Slack · $4,875 · 76 votes
  5. The Custom Emoji Page has a Reflected XSS#258198Slack · 56 votes
  6. XSS on link and window.opener#834071Slack · $1,000 · 49 votes
  7. Store XSS#187410Slack · 44 votes
  8. Stored XSS(Cross Site Scripting) In Slack App Name#159460Slack · $1,000 · 29 votes
  9. Subdomain takeover on podcasts.slack-core.com#195350Slack · $100 · 27 votes
  10. Stored XSS in files.slack.com#827606Slack · 19 votes
  11. Bypass to postMessage origin validation via FTP#210654Slack · 15 votes
  12. dom xss in https://www.slackatwork.com#196624Slack · 13 votes
  13. Open Redirect on slack.com#140447Slack · $500 · 12 votes
  14. a stored xss issue in https://files.slack.com#149011Slack · $500 · 9 votes
  15. Stored XSS Found#9774Slack · 9 votes
  16. "a stored xss issue in share post menu"#148848Slack · $500 · 8 votes
  17. Stored XSS in Slackbot Direct Messages#4561Slack · 8 votes
  18. Stored XSS in www.slack-files.com#2617Slack · 8 votes
  19. a stored xss in slack integration https://onerror.slack.com/services/import#33018Slack · $500 · 6 votes
  20. Stored XSS on this link https://sehacure.slack.com/help/requests/#2639Slack · 6 votes
  21. Stored XSS in Slack.com#6002Slack · 5 votes
  22. Executing scripts on slack-files.com using SVG#100565Slack · 4 votes
  23. Stored XSS in Slack (weird, trial and error)#96337Slack · 4 votes
  24. Stored XSS#2926Slack · 4 votes
  25. Reflected Xss#2777Slack · $500 · 4 votes
  26. Stored XSS in username.slack.com#2625Slack · 4 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in