Vimeo · disclosed reports
Cross-site Scripting
17 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Vimeo on HackerOne- reports
- 17
- paid a bounty
- 0
Every one of the 17 is a mark on the map. Named now: 1 to 17, most upvoted first.
- XSS on vimeo.com/home after other user follows you
- Stored XSS on player.vimeo.com
- XSS when using captions/subtitles on video player based on Flash (requires user interaction)
- XSS on vimeo.com | "Search within these results" feature (requires user interaction)
- Application XSS filter function Bypass may allow Multiple stored XSS
- XSS on mobile version of vimeo.com where the button "Follow" appears
- XSS on player.vimeo.com without user interaction and vimeo.com with user interaction
- Reflected XSS on vimeo.com/musicstore
- XSS on any site that includes the moogaloop flash player | deprecated embed code
- XSS in Subtitles of Vimeo Flash Player and Hubnut
- Stored XSS on vimeo.com and player.vimeo.com
- Vimeo Search - XSS Vulnerability [http://vimeo.com/search]
- XSS on Vimeo
- player.vimeo.com - Reflected XSS Vulnerability
- APIs for channels allow HTML entities that may cause XSS issue
- Vimeo.com - reflected xss vulnerability
- Vimeo.com - Reflected XSS Vulnerability
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.