Bug bounty program
OP
OpenMage
Most upvoted reports5
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Sharing products with Mail allows phishing attacks due to misconfiguration.Analysed#1083923 | Input Validation and Logic | 2021-04-25 | – | 38 |
| No error thrown when IDOR attempted while editing addressAnalysed#1085743 | Misconfiguration and Insecure Design | 2021-04-26 | – | 33 |
| CSRF in changing password after using reset password link#1086752 | Cross-Site Request Forgery | 2021-05-27 | – | 24 |
| Very long names on demo.openmage.org could redirect victim users to malicious url redirects via email contacts.#1091957 | Information Disclosure | 2021-04-29 | – | 14 |
| No Limit on Email Subscription#1085079 | Denial of Service | 2021-09-04 | – | 12 |
Subdomains7
| Name | Scope | First seen |
|---|---|---|
| demo.openmage.orgtest | In scope | 2026-11-14 |
| demo-admin.openmage.orgadmin, test | Not in the scope | 2026-11-14 |
| docs.openmage.org | Not in the scope | 2026-11-14 |
| migrate.openmage.org | Not in the scope | 2026-11-14 |
| nginxdemo.openmage.org | Not in the scope | 2026-11-14 |
| nginxdemo-admin.openmage.orgadmin | Not in the scope | 2026-11-14 |
| www.openmage.org | Listed out of scope | 2026-11-14 |
1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.