Bug bounty program
IN
Informatica
Most upvoted reports68
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| XXE through injection of a payload in the XMP metadata of a JPEG fileAnalysed#836877 | Injection and Smuggling | 2020-04-21 | – | 138 |
| No rate limiting on form[register]#2583500 | Access Control | – | – | 109 |
| Blind SQL injection at tsftp.informatica.com#1034625 | SQL Injection | 2020-11-16 | – | 68 |
| [careers.informatica.com] Reflected Cross Site Scripting to XSS Shell Possible#147196 | Command and Code Injection | 2016-12-31 | – | 50 |
| [rev-app.informatica.com] - XXE#105434 | Denial of Service | 2016-08-02 | – | 45 |
| [ipm.informatica.com] Sql injection Oracle#178057 | SQL Injection | 2017-01-21 | – | 28 |
| ..; bypass leading to tomcat scripts [Unauthenticated]#1004007 | Access Control | 2020-10-13 | – | 27 |
| Cross-site Scripting (XSS) - DOM - iqcard.informatica.com#1004833 | Cross-site Scripting | 2020-10-13 | – | 27 |
| [app.informaticaondemand.com] XXE#105753 | Denial of Service | 2017-04-08 | – | 25 |
| Public Github Repo Leaking Internal Credentials Leading To DiscoveryIQ Docker Access#631348 | Information Disclosure | 2019-08-06 | – | 24 |
Subdomains1,177
| Name | Scope | First seen |
|---|---|---|
| status.informatica.commonitoring | In scope | 2026-11-14 |
| metrics.informatica.commonitoring | In scope | 2026-11-14 |
| status-sit.informatica.commonitoring, test | In scope | 2026-11-14 |
| www.status.informatica.commonitoring | In scope | 2026-11-14 |
| metrics-image.informatica.commonitoring | In scope | 2026-11-14 |
| nagios-grafana.informatica.commonitoring | In scope | 2026-11-14 |
1,177 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.