Bug bounty program
MA
Mars
Most upvoted reports68
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Account Takeover in Password Reset FunctionAnalysed#3228888 | Authentication | 2025-09-02 | – | 105 |
| Reflected HTML Injection via contact (faq) search parameter on ██████████Analysed#2587101 | Cross-site Scripting | 2024-11-25 | – | 103 |
| █████████ when adding branches to your accountAnalysed#2756402 | Insecure Direct Object Reference | 2024-11-26 | – | 98 |
| Reflected HTML Injection via contact (faq) search parameter on ███]=Analysed#2578985 | Cross-site Scripting | 2024-11-25 | – | 82 |
| Unrestricted File Upload at ██████████Analysed#2357778 | File and Path Handling | 2024-02-19 | – | 78 |
| sqli on █████████ search functionalityAnalysed#2446550 | SQL Injection | 2024-06-25 | – | 72 |
| CVE-█████-35813 in █████Analysed#2200329 | File and Path Handling | 2026-02-24 | – | 71 |
| RXSS on ██████ via customerId parameterAnalysed#3126603 | Cross-site Scripting | 2025-07-28 | – | 71 |
| Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314Analysed#1452774 | Information Disclosure | 2025-09-02 | – | 67 |
| Upload profile photo and Pets addition - IDORAnalysed#2393021 | Insecure Direct Object Reference | 2024-11-21 | – | 66 |
Subdomains3,528
| Name | Scope | First seen |
|---|---|---|
| nexus.mars.comtools | In scope | 2026-11-14 |
| registry-plotlydev.mars.comtools | In scope | 2026-11-14 |
| sharepoint.mars.comtools | In scope | 2026-11-14 |
3,528 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.