Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| www.google.com-cloud-enginezfs-cartonelblaxvpn-learning-engine.com-cloud-i-user-machine-engine-engine.1.myoppo.com | Not in the scope | 2026-11-14 |
| www.google.com-cloud-surveyfs-platform-learning-engine.com-cloud-ossapihdsprod-machine-learning-i-april.1.myoppo.com | Not in the scope | 2026-11-14 |
| bvrv5k3pg8nuh0v91t70.apk.scm.18.myoppo.comgit | Not in the scope | 2026-11-14 |
| mlbsdown.apk.scm.18.myoppo.comgit | Not in the scope | 2026-11-14 |
| zh13923723458.apk.scm.18.myoppo.comgit | Not in the scope | 2026-11-14 |
| lymtjx.apk.scm.4.myoppo.comgit | Not in the scope | 2026-11-14 |
| jp.traffic.apk.scm.4.myoppo.comgit | Not in the scope | 2026-11-14 |
| iia1.apk.scm.a.myoppo.comgit | Not in the scope | 2026-11-14 |
| salary1.apk.scm.a.myoppo.comgit | Not in the scope | 2026-11-14 |
| api-phx-oln.myoppo.comapi | Not in the scope | 2026-11-14 |
| bvsbk6ngk4m183mm7b8g.repository.apk.scm.2dbc3f05-managementadministrator.api.myoppo.comapi, git | Not in the scope | 2026-11-14 |
| bvsbk6ngk4m183mm7mig.repository.apk.scm.2dbc3f05-managementadministrator.api.myoppo.comapi, git | Not in the scope | 2026-11-14 |
| bvs84ule0shsdjiih51g.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvs84ule0shsdjiihek0.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvruuhrpg8njqip9istg.repository.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| tonight.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvs41nvgk4m5emkb5pu0.2dbc3f05sitory.apk.scm.api.myoppo.comapi, git | Not in the scope | 2026-11-14 |
| apiws-phx-oln.myoppo.com | Not in the scope | 2026-11-14 |
| bbs.myoppo.com | Not in the scope | 2026-11-14 |
| so.bbs.myoppo.com | Not in the scope | 2026-11-14 |
| bbsfs.myoppo.com | Not in the scope | 2026-11-14 |
| brandhub.myoppo.com | Not in the scope | 2026-11-14 |
| brandhub-aem-eu.myoppo.com | Not in the scope | 2026-11-14 |
| bvrupvjkvfp8qckqjn70.apk.scm.cdn.myoppo.comgit | Not in the scope | 2026-11-14 |
| hq1398.apk.scm.cdn.myoppo.comgit | Not in the scope | 2026-11-14 |
| bdy.apk.scm-admins.cgi.myoppo.comgit | Not in the scope | 2026-11-14 |
| bvrv4avagi6frbdbnlv0.apk.scm-admins.cgi.myoppo.comgit | Not in the scope | 2026-11-14 |
| cdn3.apk.scm-admins.cgi.myoppo.comgit | Not in the scope | 2026-11-14 |
| bvrupe3pg8njnkca8030.2dbc3f05.repository.apk.scm.cgi.myoppo.comgit | Not in the scope | 2026-11-14 |
| color.myoppo.com | Not in the scope | 2026-11-14 |
| distributor.myoppo.com | Not in the scope | 2026-11-14 |
| drp.myoppo.com | In scope | 2026-11-14 |
| drp-apac.myoppo.com | Not in the scope | 2026-11-14 |
| drp-api-in.myoppo.comapi | Not in the scope | 2026-11-14 |
| drp-in.myoppo.com | Not in the scope | 2026-11-14 |
| dzbkindex.myoppo.com | Not in the scope | 2026-11-14 |
| dzbkjh2.myoppo.com | Not in the scope | 2026-11-14 |
| qps1.apk.scm.elb.myoppo.comgit | Not in the scope | 2026-11-14 |
| esa-reg-sg.myoppo.com | Not in the scope | 2026-11-14 |
| hd.myoppo.com | Not in the scope | 2026-11-14 |
| innereye.myoppo.com | Not in the scope | 2026-11-14 |
| ipm.myoppo.com | Not in the scope | 2026-11-14 |
| isrm.myoppo.com | Not in the scope | 2026-11-14 |
| horsma.jiaoyi.myoppo.com | Not in the scope | 2026-11-14 |
| pissaro.jiaoyi.myoppo.com | Not in the scope | 2026-11-14 |
| poo.jiaoyi.myoppo.com | Not in the scope | 2026-11-14 |
| scream.jiaoyi.myoppo.com | Not in the scope | 2026-11-14 |
| kbase.myoppo.com | Not in the scope | 2026-11-14 |
| bvrv9ubkvfp038uihv3g.apk.scm.lan.myoppo.comgit | Not in the scope | 2026-11-14 |
| m.myoppo.com | Not in the scope | 2026-11-14 |
| m-oln.myoppo.com | Not in the scope | 2026-11-14 |
| mail.myoppo.commail | Not in the scope | 2026-11-14 |
| material-in.myoppo.com | Not in the scope | 2026-11-14 |
| newds01.myoppo.com | Not in the scope | 2026-11-14 |
| newds02.myoppo.com | Not in the scope | 2026-11-14 |
| newtq.myoppo.com | Not in the scope | 2026-11-14 |
| bvrv0irpg8nucfc423f0.apk.scm.nov.myoppo.comgit | Not in the scope | 2026-11-14 |
| fpbcode.apk.scm.nov.myoppo.comgit | Not in the scope | 2026-11-14 |
| tarpa.apk.scm.nov.myoppo.comgit | Not in the scope | 2026-11-14 |
| o-share-aem.myoppo.com | Not in the scope | 2026-11-14 |
| olearning.myoppo.com | Not in the scope | 2026-11-14 |
| olearning-eur.myoppo.com | Not in the scope | 2026-11-14 |
| olearning-ind.myoppo.com | Not in the scope | 2026-11-14 |
| olearning-me.myoppo.com | Not in the scope | 2026-11-14 |
| olearning-sgp.myoppo.com | Not in the scope | 2026-11-14 |
| olearning-sgp-replay.myoppo.com | Not in the scope | 2026-11-14 |
| oln-cdn.myoppo.com | Not in the scope | 2026-11-14 |
| oln-cs.myoppo.com | Not in the scope | 2026-11-14 |
| oln-ind.myoppo.com | Not in the scope | 2026-11-14 |
| oln-realme.myoppo.com | Not in the scope | 2026-11-14 |
| oln-sgp.myoppo.com | Not in the scope | 2026-11-14 |
| operation-in.myoppo.com | Not in the scope | 2026-11-14 |
| operation-sg.myoppo.com | Not in the scope | 2026-11-14 |
| oretail-ap.myoppo.com | Not in the scope | 2026-11-14 |
| ormbi.myoppo.com | Not in the scope | 2026-11-14 |
| os-rmstest.myoppo.com | Not in the scope | 2026-11-14 |
| passage-oln.myoppo.com | Not in the scope | 2026-11-14 |
| pay.myoppo.com | Not in the scope | 2026-11-14 |
| bvrv58fagi6frgmdpun0.appversion.apk.scm.pc.myoppo.comgit | Not in the scope | 2026-11-14 |
| bvruurbpg8nudf1t2hog.apk.scm.w3.php.myoppo.comgit | Not in the scope | 2026-11-14 |
| platform-vernemq-prod.myoppo.com | Not in the scope | 2026-11-14 |
| qam.myoppo.com | Not in the scope | 2026-11-14 |
| rmsdev.myoppo.com | Not in the scope | 2026-11-14 |
| rmspre.myoppo.com | Not in the scope | 2026-11-14 |
| rmstest.myoppo.com | Not in the scope | 2026-11-14 |
| rtc-realme.myoppo.com | Not in the scope | 2026-11-14 |
| rtc1.myoppo.com | Not in the scope | 2026-11-14 |
| rtc2.myoppo.com | Not in the scope | 2026-11-14 |
| s-oln.myoppo.com | Not in the scope | 2026-11-14 |
| g9i.13.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| pro.13.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| bvrutnmuc7d3i8trmdeg.14.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| bvs44snagi68m01o1ljg.2.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| bvrusnbkvfp8sduqmgag.repository.2009.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| cedarmonte.2010.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| dm5.global.2012.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| bvruu67agi6d68crs660.2dbc3f05.repository.2020.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| dmy.2dbc3f05-authenticate.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| bvrv5c7agi6ae9icpkag.2dbc3f05-yezi-mobile-2dbc3f05.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
| liyuan.2dbc3f05-yezi-mobile-2dbc3f05.apk.scm.myoppo.comgit | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.