Bug bounty program
MA
Mars
Most upvoted reports68
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Account Takeover in Password Reset FunctionAnalysed#3228888 | Authentication | 2025-09-02 | – | 105 |
| Reflected HTML Injection via contact (faq) search parameter on ██████████Analysed#2587101 | Cross-site Scripting | 2024-11-25 | – | 103 |
| █████████ when adding branches to your accountAnalysed#2756402 | Insecure Direct Object Reference | 2024-11-26 | – | 98 |
| Reflected HTML Injection via contact (faq) search parameter on ███]=Analysed#2578985 | Cross-site Scripting | 2024-11-25 | – | 82 |
| Unrestricted File Upload at ██████████Analysed#2357778 | File and Path Handling | 2024-02-19 | – | 78 |
| sqli on █████████ search functionalityAnalysed#2446550 | SQL Injection | 2024-06-25 | – | 72 |
| CVE-█████-35813 in █████Analysed#2200329 | File and Path Handling | 2026-02-24 | – | 71 |
| RXSS on ██████ via customerId parameterAnalysed#3126603 | Cross-site Scripting | 2025-07-28 | – | 71 |
| Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314Analysed#1452774 | Information Disclosure | 2025-09-02 | – | 67 |
| Upload profile photo and Pets addition - IDORAnalysed#2393021 | Insecure Direct Object Reference | 2024-11-21 | – | 66 |
Subdomains3,528
| Name | Scope | First seen |
|---|---|---|
| 120daygetfit.extragum.com | In scope | 2026-11-14 |
| 120dayrewards.extragum.com | In scope | 2026-11-14 |
| api.extragum.comapi | In scope | 2026-11-14 |
| origin.api.extragum.comapi | In scope | 2026-11-14 |
| preprod.api.extragum.comapi, staging | In scope | 2026-11-14 |
| origin.preprod.api.extragum.comapi, staging | In scope | 2026-11-14 |
| www.preprod.api.extragum.comapi, staging | In scope | 2026-11-14 |
| stage.api.extragum.comapi, staging | In scope | 2026-11-14 |
| origin.stage.api.extragum.comapi, staging | In scope | 2026-11-14 |
| www.api.extragum.comapi | In scope | 2026-11-14 |
| bts.extragum.com | In scope | 2026-11-14 |
| preprod.bts.extragum.comstaging | In scope | 2026-11-14 |
| www.preprod.bts.extragum.comstaging | In scope | 2026-11-14 |
| stage.bts.extragum.comstaging | In scope | 2026-11-14 |
| origin.stage.bts.extragum.comstaging | In scope | 2026-11-14 |
| www.bts.extragum.com | In scope | 2026-11-14 |
| dev.extragum.comdev | In scope | 2026-11-14 |
| dev-loadtest.extragum.comdev | In scope | 2026-11-14 |
| giveitup.extragum.com | In scope | 2026-11-14 |
| www.giveitup.extragum.com | In scope | 2026-11-14 |
| gumswap.extragum.com | In scope | 2026-11-14 |
| www.gumswap.extragum.com | In scope | 2026-11-14 |
| live.extragum.com | In scope | 2026-11-14 |
| live-loadtest.extragum.com | In scope | 2026-11-14 |
| live-mena.extragum.com | In scope | 2026-11-14 |
| loadtest.extragum.com | In scope | 2026-11-14 |
| m.extragum.com | In scope | 2026-11-14 |
| migration.extragum.com | In scope | 2026-11-14 |
| origin.extragum.com | In scope | 2026-11-14 |
| promo.extragum.com | In scope | 2026-11-14 |
| stage.promo.extragum.comstaging | In scope | 2026-11-14 |
| www.promo.extragum.com | In scope | 2026-11-14 |
| qa.extragum.comtest | In scope | 2026-11-14 |
| qa-loadtest.extragum.comtest | In scope | 2026-11-14 |
| refreshers.extragum.com | In scope | 2026-11-14 |
| www.refreshers.extragum.com | In scope | 2026-11-14 |
| sample.extragum.com | In scope | 2026-11-14 |
| stage.extragum.comstaging | In scope | 2026-11-14 |
| m.stage.extragum.comstaging | In scope | 2026-11-14 |
| orgin.m.stage.extragum.comstaging | In scope | 2026-11-14 |
| origin.m.stage.extragum.comstaging | In scope | 2026-11-14 |
| migration.stage.extragum.comstaging | In scope | 2026-11-14 |
| origin.stage.extragum.comstaging | In scope | 2026-11-14 |
| test.extragum.comtest | In scope | 2026-11-14 |
| test-loadtest.extragum.comtest | In scope | 2026-11-14 |
| test-mena.extragum.comtest | In scope | 2026-11-14 |
| test1.extragum.comtest | In scope | 2026-11-14 |
| walgreens.extragum.com | In scope | 2026-11-14 |
| www.walgreens.extragum.com | In scope | 2026-11-14 |
| www.extragum.com | In scope | 2026-11-14 |
3,528 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.