Skip to content
Connect AISign inSign up free

Bug bounty program

PA

PayPal

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
42
Disclosed reports
13
Subdomains
17,149
Vendor on CyberSIXT
Paypal (21 CVEs, 0 exploited)

Most upvoted reports13

All reports
Most upvoted reports of PayPal
ReportWeaknessDisclosedBountyVotes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152Injection and Smuggling2019-08-07$20,0002,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737Authentication2020-01-08$15,3001,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585Command and Code Injection2021-02-09$30,000946
DoS on PayPal via web cache poisoningAnalysed#622122Denial of Service2019-10-23$9,700851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081Insecure Direct Object Reference2019-07-30$10,500797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147Injection and Smuggling2019-08-07$18,900685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443Open Redirect2019-02-07–188
[Venmo Android] Remote theft of user sessionAnalysed#401940Open Redirect2019-02-07–151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835Cross-site Scripting2020-05-19–137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200Cross-site Scripting2018-11-06–100

Subdomains17,149

Root:loanbuilder.com
Scope
Name suggests
First seen
Text fileClear filters23 names
Subdomains of PayPal
NameScopeFirst seen
api.loanbuilder.comapiIn scope2026-11-14
autodiscover.loanbuilder.commailNot in the scope2026-11-14
dev.loanbuilder.comdevNot in the scope2026-11-14
api.dev.loanbuilder.comapi, devNot in the scope2026-11-14
dmgongwebhook.loanbuilder.comNot in the scope2026-11-14
duapi.loanbuilder.comNot in the scope2026-11-14
dynapi.loanbuilder.comNot in the scope2026-11-14
email.loanbuilder.comNot in the scope2026-11-14
get.loanbuilder.comNot in the scope2026-11-14
go.loanbuilder.comNot in the scope2026-11-14
info.loanbuilder.comNot in the scope2026-11-14
ist.loanbuilder.comNot in the scope2026-11-14
api.ist.loanbuilder.comapiNot in the scope2026-11-14
mail.loanbuilder.commailNot in the scope2026-11-14
msoid.loanbuilder.comNot in the scope2026-11-14
my.loanbuilder.comIn scope2026-11-14
sbx.loanbuilder.comtestNot in the scope2026-11-14
test.loanbuilder.comtestNot in the scope2026-11-14
try.loanbuilder.comNot in the scope2026-11-14
www.try.loanbuilder.comNot in the scope2026-11-14
uat.loanbuilder.comtestNot in the scope2026-11-14
api.uat.loanbuilder.comapi, testNot in the scope2026-11-14
www.loanbuilder.comIn scope2026-11-14

17,017 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated