Bug bounty program

Flickr

Platform: HackerOne
Bounties: Pays
Assets in scope: 5
Disclosed reports: 16
Subdomains: 255

Most upvoted reports16

Most upvoted reports of Flickr
Report	Weakness	Disclosed	Bounty	Votes
Flickr Account Takeover using AWS Cognito APIAnalysed#1342088	Authentication	2021-12-18	–	440
Arbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/uploadAnalysed#487008	Command and Code Injection	2020-01-25	–	340
critical server misconfiguration lead to access to any user sensitive data which include user email and passwordAnalysed#1365738	Input Validation and Logic	2021-11-02	$500	116
CSRF in Account Deletion feature (https://www.flickr.com/account/delete)#615448	Cross-Site Request Forgery	2021-09-14	–	92
High resource consumption by insufficient sanitization of forum threads pagination#1916400	Denial of Service	2025-11-24	$479	75
Incorrect Deep-link validation leading to unresponsive application and device#1157795	Input Validation and Logic	2024-07-06	–	64
IDOR may allow access to non-public photos#1737943	Insecure Direct Object Reference	2024-07-06	–	61
Stored XSS in photos_user_map.gne#1534636	Cross-site Scripting	2022-05-23	$3,263	54
Information Disclosure: .dockerignore file is publicly accessible#2888001	No weakness recorded	2025-01-14	–	45
Critical broken cookie signing on dagobah.flickr.com#1440290	Input Validation and Logic	2022-05-24	$479	30

Subdomains255

Root:flickr.com

flickr.com255

Scope:No domain scope published

Name suggests

First seen

Text fileClear filters0 names

No subdomain matches

Remove a filter or pick another root.

Clear filters

242 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.