Skip to content
Sign in

Bug bounty program

ME

MercadoLibre

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
78
Disclosed reports
6
Subdomains
385

Most upvoted reports6

Most upvoted reports of MercadoLibre
ReportWeaknessDisclosedBountyVotes
Sale cancellations from other sellers without restrictionsAnalysed#2495989Insecure Direct Object Reference2025-03-06–144
Stored Cross-Site Scripting in mercadopago.com.arAnalysed#1955485Cross-site Scripting2025-03-13–109
Stored XSS in reclamosAnalysed#1675516Cross-site Scripting2024-09-09–97
Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)#2289836Command and Code Injection2024-06-28–66
Reflected Cross Site Scripting#1093577No weakness recorded2024-07-23–42
Es posible poder navegar a cualquier pagina en Point Smart application#2778400No weakness recorded2024-12-11–41

Subdomains385

Root
Scope
Name suggests
First seen
Text file385 names
Subdomains of MercadoLibre
NameScopeFirst seen
a.mercadolibre.comIn scope2026-11-14
o18.sg.a.mercadolibre.comIn scope2026-11-14
o19.sg.a.mercadolibre.comIn scope2026-11-14
o3.ptr3169.sg.a.mercadolibre.comIn scope2026-11-14
o6.ptr4588.sg.a.mercadolibre.comIn scope2026-11-14
o4.ptr5260.sg.a.mercadolibre.comIn scope2026-11-14
o2.ptr6987.sg.a.mercadolibre.comIn scope2026-11-14
o5.ptr8540.sg.a.mercadolibre.comIn scope2026-11-14
accountrecovery.mercadolibre.comIn scope2026-11-14
addresses.mercadolibre.comIn scope2026-11-14
advertising.mercadolibre.comIn scope2026-11-14
alejandria-int.mercadolibre.comIn scope2026-11-14
analytics.mercadolibre.comIn scope2026-11-14
andes.mercadolibre.comIn scope2026-11-14
andes-landings.mercadolibre.comIn scope2026-11-14
andesx.mercadolibre.comIn scope2026-11-14
antares-mco.mercadolibre.comIn scope2026-11-14
antares-mla-arias.mercadolibre.comIn scope2026-11-14
antares-mla-arias-bk.mercadolibre.comIn scope2026-11-14
antares-mla-arias-bkp.mercadolibre.comIn scope2026-11-14
antares-mla-arias-ppal.mercadolibre.comIn scope2026-11-14
antares-mla-cordoba.mercadolibre.comIn scope2026-11-14
antares-mla-pp.mercadolibre.comIn scope2026-11-14
antares-mla-sanluis.mercadolibre.comIn scope2026-11-14
antares-mlb.mercadolibre.comIn scope2026-11-14
antares-mlc.mercadolibre.comIn scope2026-11-14
antares-mlc-bkp.mercadolibre.comIn scope2026-11-14
antares-mlcol.mercadolibre.comIn scope2026-11-14
antares-mlm.mercadolibre.comIn scope2026-11-14
antares-mlu.mercadolibre.comIn scope2026-11-14
antares-mlu-wtc.mercadolibre.comIn scope2026-11-14
antares-mlv.mercadolibre.comIn scope2026-11-14
antares-usa.mercadolibre.comIn scope2026-11-14
api.mercadolibre.comapiIn scope2026-11-14
api-cbt.mercadolibre.comapiIn scope2026-11-14
www.api.mercadolibre.comapiIn scope2026-11-14
applications.mercadolibre.comIn scope2026-11-14
apps.mercadolibre.comIn scope2026-11-14
appstore.mercadolibre.comIn scope2026-11-14
arte-antiguedades.mercadolibre.comIn scope2026-11-14
articulo.mercadolibre.comIn scope2026-11-14
artifacts.mercadolibre.comIn scope2026-11-14
atl-dnsinf-i1.mercadolibre.comIn scope2026-11-14
auth.mercadolibre.comauthIn scope2026-11-14
auth-identity.mercadolibre.comauthIn scope2026-11-14
auto.mercadolibre.comIn scope2026-11-14
autos.mercadolibre.comIn scope2026-11-14
ayuda.mercadolibre.comIn scope2026-11-14
refpayments.baloto.mercadolibre.comIn scope2026-11-14
test.baloto.mercadolibre.comtestIn scope2026-11-14
bc-jpm-beta-ssl.mercadolibre.comstagingIn scope2026-11-14
bc-jpm-beta-sslv2.mercadolibre.comstagingIn scope2026-11-14
bc-jpm-beta-transfer.mercadolibre.comstagingIn scope2026-11-14
bc-jpm-beta-update.mercadolibre.comstagingIn scope2026-11-14
bc-jpm-prod-ssl.mercadolibre.comIn scope2026-11-14
bc-jpm-prod-transfer.mercadolibre.comIn scope2026-11-14
blog.mercadolibre.comIn scope2026-11-14
buyingflow.mercadolibre.comIn scope2026-11-14
ns4.resultscan.c.mercadolibre.comIn scope2026-11-14
cacique.mercadolibre.comIn scope2026-11-14
cadastromlb.mercadolibre.comIn scope2026-11-14
camioneta.mercadolibre.comIn scope2026-11-14
careers-meli.mercadolibre.comIn scope2026-11-14
casa-villa.mercadolibre.comIn scope2026-11-14
casas.mercadolibre.comIn scope2026-11-14
category.mercadolibre.comIn scope2026-11-14
cbt.mercadolibre.comIn scope2026-11-14
celulares.mercadolibre.comIn scope2026-11-14
centrodepartners.mercadolibre.comIn scope2026-11-14
cerbero.mercadolibre.comIn scope2026-11-14
chat.mercadolibre.comIn scope2026-11-14
chattest.mercadolibre.comIn scope2026-11-14
chico.mercadolibre.comIn scope2026-11-14
citiportal.mercadolibre.comIn scope2026-11-14
www.citiportal.mercadolibre.comIn scope2026-11-14
app.villafeet.co.mercadolibre.comIn scope2026-11-14
coleccionables.mercadolibre.comIn scope2026-11-14
compra.mercadolibre.comIn scope2026-11-14
computacion.mercadolibre.comIn scope2026-11-14
concursodefotografia.mercadolibre.comIn scope2026-11-14
confirmacao.mercadolibre.comIn scope2026-11-14
content.mercadolibre.comIn scope2026-11-14
www.content.mercadolibre.comIn scope2026-11-14
correo.mercadolibre.comIn scope2026-11-14
crmla.mercadolibre.comIn scope2026-11-14
curiosidades.mercadolibre.comIn scope2026-11-14
dare-transnetwork-adapter.mercadolibre.comIn scope2026-11-14
data.mercadolibre.comIn scope2026-11-14
www.data.mercadolibre.comIn scope2026-11-14
dc4-dnsinf-i1.mercadolibre.comIn scope2026-11-14
dc4-iron05.mercadolibre.comIn scope2026-11-14
dc4-iron05-b.mercadolibre.comIn scope2026-11-14
dc4-iron05-c.mercadolibre.comIn scope2026-11-14
dc4-iron05-d.mercadolibre.comIn scope2026-11-14
dc4-iron05-e.mercadolibre.comIn scope2026-11-14
dc4-iron08.mercadolibre.comIn scope2026-11-14
dc4-iron08-b.mercadolibre.comIn scope2026-11-14
dc4-iron08-c.mercadolibre.comIn scope2026-11-14
dc4-iron08-d.mercadolibre.comIn scope2026-11-14
dc4-iron08-e.mercadolibre.comIn scope2026-11-14

385 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in