Skip to content
Sign in

Bug bounty program

FL

Flickr

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
5
Disclosed reports
16
Subdomains
255

Most upvoted reports16

All reports
Most upvoted reports of Flickr
ReportWeaknessDisclosedBountyVotes
Flickr Account Takeover using AWS Cognito APIAnalysed#1342088Authentication2021-12-18–440
Arbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/uploadAnalysed#487008Command and Code Injection2020-01-25–340
critical server misconfiguration lead to access to any user sensitive data which include user email and passwordAnalysed#1365738Input Validation and Logic2021-11-02$500116
CSRF in Account Deletion feature (https://www.flickr.com/account/delete)#615448Cross-Site Request Forgery2021-09-14–92
High resource consumption by insufficient sanitization of forum threads pagination#1916400Denial of Service2025-11-24$47975
Incorrect Deep-link validation leading to unresponsive application and device#1157795Input Validation and Logic2024-07-06–64
IDOR may allow access to non-public photos#1737943Insecure Direct Object Reference2024-07-06–61
Stored XSS in photos_user_map.gne#1534636Cross-site Scripting2022-05-23$3,26354
Information Disclosure: .dockerignore file is publicly accessible#2888001No weakness recorded2025-01-14–45
Critical broken cookie signing on dagobah.flickr.com#1440290Input Validation and Logic2022-05-24$47930

Subdomains255

Root
Scope
Name suggests
First seen
Text file255 names
Subdomains of Flickr
NameScopeFirst seen
gq1.farm6.static.flickr.comIn scope2026-11-14
farm66.static.flickr.comIn scope2026-11-14
farm7.static.flickr.comIn scope2026-11-14
bf1.farm7.static.flickr.comIn scope2026-11-14
ne1.farm7.static.flickr.comIn scope2026-11-14
farm8.static.flickr.comIn scope2026-11-14
farm9.static.flickr.comIn scope2026-11-14
farmx.static.flickr.comIn scope2026-11-14
pool.static.flickr.comIn scope2026-11-14
farm8.staticfarm8.static.flickr.comIn scope2026-11-14
static1.flickr.comIn scope2026-11-14
static2.flickr.comIn scope2026-11-14
static3.flickr.comIn scope2026-11-14
static4.flickr.comIn scope2026-11-14
static6.flickr.comIn scope2026-11-14
staticalpha.flickr.comIn scope2026-11-14
stats.flickr.comIn scope2026-11-14
support.flickr.comIn scope2026-11-14
svn.flickr.comgitIn scope2026-11-14
t.flickr.comIn scope2026-11-14
farm5.tatic.flickr.comIn scope2026-11-14
test-flickr.flickr.comtestIn scope2026-11-14
test-identity-api.flickr.comapi, auth, testIn scope2026-11-14
test-jubilee.flickr.comtestIn scope2026-11-14
test-professorx.flickr.comtestIn scope2026-11-14
tools.flickr.comIn scope2026-11-14
u003ewww.flickr.comIn scope2026-11-14
uh.flickr.comIn scope2026-11-14
uh-qa.flickr.comtestIn scope2026-11-14
ultracdn.flickr.comIn scope2026-11-14
up.flickr.comIn scope2026-11-14
up-dev.flickr.comdevIn scope2026-11-14
up-resume.flickr.comIn scope2026-11-14
upkeep.flickr.comIn scope2026-11-14
upload.flickr.comdataIn scope2026-11-14
uploader.flickr.comIn scope2026-11-14
wallet.flickr.comIn scope2026-11-14
widgets.flickr.comIn scope2026-11-14
www.flickr.comIn scope2026-11-14
real.www-pool.flickr.comIn scope2026-11-14
www-us.flickr.comIn scope2026-11-14
ats-rw.www.flickr.comIn scope2026-11-14
real.www.flickr.comIn scope2026-11-14
rw.www.flickr.comIn scope2026-11-14
www1.flickr.comIn scope2026-11-14
www12.flickr.comIn scope2026-11-14
www2.flickr.comIn scope2026-11-14
www21.flickr.comIn scope2026-11-14
www3.flickr.comIn scope2026-11-14
www4.flickr.comIn scope2026-11-14
www5.flickr.comIn scope2026-11-14
www6.flickr.comIn scope2026-11-14
www7.flickr.comIn scope2026-11-14
ycpi-api.flickr.comapiIn scope2026-11-14
zabbix.flickr.commonitoringIn scope2026-11-14

242 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in