Bug bounty program
OP
OPPO
Most upvoted reports4
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Arbitrary thread deletion on c.realme.com#869705 | Insecure Direct Object Reference | – | $600 | 73 |
| Information Disclosure at https://portal.finzfin.com/1.txt#1011073 | Information Disclosure | – | $50 | 20 |
| No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points#887684 | Input Validation and Logic | – | $100 | 14 |
| RXSS in https://store.oppomobile.com/#869870 | Cross-site Scripting | – | $100 | 10 |
Subdomains3,641
| Name | Scope | First seen |
|---|---|---|
| www.google.com-administratorment-cms.tepoch-authorization-prod.finzfin.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-94e3ff-google-google-content-cdn-rpc-local.dashboard.assets.restricted-prd.activity.heytapdownload.comadmin, api, dev | Not in the scope | 2026-11-14 |
| www.google.com-smart-control-panel-audio-bot-account-host-applications.heytapimage.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-control-panel-static-cpc-account-host-applications.heytapimage.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-adsense-control-cn01a-otrial-start-manage-money-online.dogfoodingk8s.heytapimage.comadmin | Not in the scope | 2026-11-14 |
| admin.crm.keke.cnadmin | Not in the scope | 2026-11-14 |
| cms-hth.myoas.comadmin | Not in the scope | 2026-11-14 |
| google.comdevelopmentmobileclient.skinscomv2-administrator.test1-omsproxy-e6zyxw.cloudstaff.tomcat0.myoas.netadmin, test | Not in the scope | 2026-11-14 |
| bvs3tkbkvfp3fnf064b0.admin.apk.scm.myoppo.comadmin, git | Not in the scope | 2026-11-14 |
| tonight.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvs84ule0shsdjiih51g.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvs84ule0shsdjiihek0.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| bvruuhrpg8njqip9istg.repository.apk.scm.jinx-2dbc3f05-management.api.myoppo.comadmin, api, git | Not in the scope | 2026-11-14 |
| www.google.combucky.kbdregion.www.email.appenginei-adm.vcdc.az.nearme.com.cnadmin | Not in the scope | 2026-11-14 |
| www.google.combucky.kbdregion.www.email.appopayfsi-adm.vcdc.az.nearme.com.cnadmin | Not in the scope | 2026-11-14 |
| www.google.combucky.kbdregion.www.email.apptomcati-adm.vcdc.a88b02az.nearme.com.cnadmin | Not in the scope | 2026-11-14 |
| admin.oppo.cnadmin | Not in the scope | 2026-11-14 |
| pre-wx-admin.oppo.cnadmin | Not in the scope | 2026-11-14 |
| www.google.com-cloud-11payment-10-learning-enginepaymentprodmrc-mbu.cms1.oppo.cnadmin | Not in the scope | 2026-11-14 |
| cms.oppo.comadmin | Not in the scope | 2026-11-14 |
| sow-cms.oppo.comadmin | Not in the scope | 2026-11-14 |
| ind-sow-cms.oppo.comadmin | Not in the scope | 2026-11-14 |
| sgp-sow-cms.oppo.comadmin | Not in the scope | 2026-11-14 |
| ind-sow-cms-app.oppo.comadmin | Not in the scope | 2026-11-14 |
| lockcard-admin-in.oppo.comadmin | Not in the scope | 2026-11-14 |
| redirectme.netoppofindruleus-admin1.jpw6qr.16.1.0.oppofind.comadmin | Not in the scope | 2026-11-14 |
| 432818.teamgetauthenticate.redirectme.netoppofind.panel0.oppofind.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-2-panel-digital-archive-pre-www-applications.global.realmebbs.comadmin, legacy | Not in the scope | 2026-11-14 |
| www.google.com-smart-control-panel-digital-system-host-applications.global.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-control-panel-digital-system-host-applications.system.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-test-panel-digital-k8s-dev-host-statslications.diadmal.realmebbs.comadmin, dev, test, tools | Not in the scope | 2026-11-14 |
| www.google.com-smart-control-panel-digital-system-host-applicationsv.global.2.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-1-panel-raw-paywall-pre-www-applications.partner-global-v1.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-2-panel-digital-archive-pre-www-applications.global.elastic-cms.realmebbs.comadmin, data, legacy | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-emails.com-smart-2-panel-digital-com-host-wireless.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-control-panel-digital-apidocssystem-host-applications.staging.global-emailorigin.realmebbs.comadmin, staging | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-host15-host-correos.com-smart-2-panel-digital-com-host-correosount.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-applications.com-smart-2-panel-digital-com-host-host15.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-applications.com-smart-2-panel-digital-com-host-ulysse.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-images0-host-applications.com-smart-2-panel-digital-com-host-host15.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-applications.com-smart-2-panel-digital-com-host-wireless.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-inside-host-applications.com-smart-2-panel-digital-com-host-firewall2.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-bounces-system-host-copyright.com-smart-2-panel-bounces-com-host-copyrightount.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-crystal-system-host-copyright.com-smart-2-panel-crystal-com-host-copyrightount.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-servicios-host-copyright.com-smart-2-panel-digital-com-host-copyrightount.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-applications.com-smart-2-panel-digital-com-host-applicationsount.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-applications.com-smart-2-panel-digital-com-host-applicationsountapi.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-applications-retail.com-smart-2-panel-digital-com-host-applicationsount.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-applicationsaccounting.com-smart-2-panel-digital-com-host-applicationsount.realmebbs.comadmin | Not in the scope | 2026-11-14 |
| www.google.com-smart-0-account-digital-system-host-applications.com-smart-2-panel-digital-com-host-applicationsountneutron-api.realmebbs.comadmin, api | Not in the scope | 2026-11-14 |
| adm.mail.11app.info.realmepaysa.comadmin, mail | Not in the scope | 2026-11-14 |
| adm.mail.11edge.info.realmepaysa.comadmin, mail | Not in the scope | 2026-11-14 |
| adm.mail.edge.10.info.realmepaysa.comadmin, mail | Not in the scope | 2026-11-14 |
| adm.mailer.10mail.info.realmepaysa.comadmin, mail | Not in the scope | 2026-11-14 |
| 10-administrator-mail.info.realmepaysa.comadmin, mail | Not in the scope | 2026-11-14 |
| authorization.adm.11-mail.info.realmepaysa.comadmin, mail | Not in the scope | 2026-11-14 |
| 4broduction-admin.admin.11-mail.info.realmepaysa.comadmin, mail | Not in the scope | 2026-11-14 |
| 4broduction-admin.admin.mail.14.info.realmepaysa.comadmin, mail | Not in the scope | 2026-11-14 |
| admin.crm1.wanyol.comadmin | Not in the scope | 2026-11-14 |
| apple-soc-prototype5-otatest-backend-hideip.console-uat-srm.wanyol.comadmin, test | Not in the scope | 2026-11-14 |
16 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.