TikTok · disclosed reports
Cross-site Scripting
34 disclosed reports · $12,329 paid · 34 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open TikTok on HackerOne- reports
- 34
- valid
- 34
- paid a bounty
- 7
Every one of the 34 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration
- Reflected XSS in TikTok endpoints
- Stored-XSS-ads.tiktok.com
- Stored XSS on TikTok Ads
- Reflected XSS on Pangle Endpoint
- HTML Injection on TikTok Ads
- DOM XSS in tiktok.com/login via the redirect_url parameter
- Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/
- Reflected xss on ads.tiktok.com using `from` parameter.
- DOM XSS on ads.tiktok.com
- Lynxview JS interfaces Takeover via deeplink traversal
- Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).
- CRLF to XSS & Open Redirection
- Stored XSS on TikTok Live Form
- Reflected XSS on TikTok Website
- Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd]
- XSS Payload on TikTok Seller Center endpoint
- Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text field
- XSS on tiktok.com
- Cross site scripting via file upload in subdomain ads.tiktok.com
- Cross Site Scripting using Email parameter in Ads endpoint 1
- RXSS on TikTok endpoints
- XSS at TikTok Ads Endpoint
- HTML Injection via Email Share
- RXSS via region parameter
- Stored XSS in the ticketing system
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.