Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
42
Disclosed reports
13
Subdomains
17,149
Vendor on CyberSIXT
Paypal (21 CVEs, 0 exploited)

Most upvoted reports13

All reports
Most upvoted reports of PayPal
ReportWeaknessDisclosedBountyVotes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152Injection and Smuggling2019-08-07$20,0002,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737Authentication2020-01-08$15,3001,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585Command and Code Injection2021-02-09$30,000946
DoS on PayPal via web cache poisoningAnalysed#622122Denial of Service2019-10-23$9,700851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081Insecure Direct Object Reference2019-07-30$10,500797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147Injection and Smuggling2019-08-07$18,900685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443Open Redirect2019-02-07–188
[Venmo Android] Remote theft of user sessionAnalysed#401940Open Redirect2019-02-07–151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835Cross-site Scripting2020-05-19–137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200Cross-site Scripting2018-11-06–100

Subdomains17,149

Subdomains of PayPal
NameScopeFirst seen
admin.venmo.comadminIn scope2026-11-14
atmosphere-sand-eu-cent-tes-panet-panel-qa-eu.venmo.comadmin, testIn scope2026-11-14
atmosphermes-panel-qa-eu-centegrafanal-1.venmo.comadmin, testIn scope2026-11-14
atmosphere-sand-eu-cent-tes-panet-panel-qa-eu.beta.venmo.comadmin, staging, testIn scope2026-11-14
blue-front-panel-proxywebhook-dev-api.beta.venmo.comadmin, api, dev, stagingIn scope2026-11-14
disputinel-provisionsul-panel.beta.venmo.comadmin, stagingIn scope2026-11-14
docs-dashboard-sand.beta.venmo.comadmin, stagingIn scope2026-11-14
graphiternet-panel.beta.venmo.comadmin, stagingIn scope2026-11-14
k8s-dashboard-dev.beta.venmo.comadmin, dev, staging, toolsIn scope2026-11-14
k8s-dashboard-dev-api.beta.venmo.comadmin, api, dev, staging, toolsIn scope2026-11-14
k8s-dashboard-dev-us-westvip-b.beta.venmo.comadmin, dev, staging, toolsIn scope2026-11-14
k8s-dashboard-devtools.beta.venmo.comadmin, staging, toolsIn scope2026-11-14
k8s-dashboard-processor-proces.beta.venmo.comadmin, staging, toolsIn scope2026-11-14
k8s-dashboard-prod-us-east-2.beta.venmo.comadmin, staging, toolsIn scope2026-11-14
k8s-dashboard-sav.beta.venmo.comadmin, staging, toolsIn scope2026-11-14
k8s-dataprod-us-east-door-dashboard-silot-raz01-origin-na.beta.venmo.comadmin, staging, toolsIn scope2026-11-14
mes-panel-sand-us-west-2.beta.venmo.comadmin, stagingIn scope2026-11-14
ops-panel-dev-us-websitestcr.beta.venmo.comadmin, dev, stagingIn scope2026-11-14
ops-panel-prod-us-east-1.beta.venmo.comadmin, stagingIn scope2026-11-14
panel-devtools.beta.venmo.comadmin, stagingIn scope2026-11-14
panel-pay-services.beta.venmo.comadmin, stagingIn scope2026-11-14
panel-payflowlink.beta.venmo.comadmin, stagingIn scope2026-11-14
panel-prod-us-westvip-a.beta.venmo.comadmin, stagingIn scope2026-11-14
panel-qa-us-west-1.beta.venmo.comadmin, staging, testIn scope2026-11-14
panel-qa-us-west-door-us-webconf.beta.venmo.comadmin, staging, testIn scope2026-11-14
panel-sand-us-east-2.beta.venmo.comadmin, stagingIn scope2026-11-14
phx-origin-histrations-panel-qa-us-east-2.beta.venmo.comadmin, staging, testIn scope2026-11-14
pilot-coupons-panel-dev-us-east-2.beta.venmo.comadmin, dev, stagingIn scope2026-11-14
slc-a-origin-posphermes-panel-develope.beta.venmo.comadmin, stagingIn scope2026-11-14
slc-b-origin-pointegrations-panel-qa-eu-cent-panet.beta.venmo.comadmin, staging, testIn scope2026-11-14
trinitor-panel-prod-us-east-ipnpb-1.beta.venmo.comadmin, stagingIn scope2026-11-14
vps-panel-pro.beta.venmo.comadmin, stagingIn scope2026-11-14
vps-panel-prod-eu-centive-c.beta.venmo.comadmin, stagingIn scope2026-11-14
3pimages-panel-proxo.blog.venmo.comadminIn scope2026-11-14
admin-www.blog.venmo.comadminIn scope2026-11-14
blue-front-panel-prod-us-west-2.blog.venmo.comadminIn scope2026-11-14
cdn-dashboard-qa-us-east-2.blog.venmo.comadmin, testIn scope2026-11-14
cybernet-panel-prod-eu-centinel.blog.venmo.comadminIn scope2026-11-14
cybernetes-panel-proces.blog.venmo.comadminIn scope2026-11-14
dcg01-origin-mobileclient-panel-prod.blog.venmo.comadminIn scope2026-11-14
dcg11-origin-pointes-panel.blog.venmo.comadminIn scope2026-11-14
dubsiter-panel-swiftfinancopopulatory-1.blog.venmo.comadminIn scope2026-11-14
grations-panel-promotions.blog.venmo.comadminIn scope2026-11-14
k8s-dashboard-blue-front-2.blog.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-blue-front-data-api.blog.venmo.comadmin, api, toolsIn scope2026-11-14
k8s-dashboard-blue-front-panel-qa-us-east-2.blog.venmo.comadmin, test, toolsIn scope2026-11-14
k8s-dashboard-blue-frontransactionsul-prod.blog.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-blue-svcs.blog.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-dev-us-webconf.blog.venmo.comadmin, dev, toolsIn scope2026-11-14
k8s-dashboard-prod-eu-centing.blog.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-qa-us-west.blog.venmo.comadmin, test, toolsIn scope2026-11-14
k8s-dashboard-sandbox-elb.blog.venmo.comadmin, test, toolsIn scope2026-11-14
k8s-dashboard-silot-panetprod.blog.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-simobile-10a.blog.venmo.comadmin, toolsIn scope2026-11-14
lb-greloper-panel-qa-eu-centofsale-3a.blog.venmo.comadmin, testIn scope2026-11-14
mercarrient-panel-prod-us.blog.venmo.comadminIn scope2026-11-14
mops-panel-provisa-mcoronavpn-api.blog.venmo.comadmin, apiIn scope2026-11-14
nexus-mod-manager.blog.venmo.comadmin, toolsIn scope2026-11-14
old-sand-us-westinel-panel-prod-us-webconflb.blog.venmo.comadmin, legacyIn scope2026-11-14
ops-panel.blog.venmo.comadminIn scope2026-11-14
origin-blue-front-dashboard-sand-us-east-2.blog.venmo.comadminIn scope2026-11-14
origin-couponsul-prod-eu-cent-dashboard-blue-front-2.blog.venmo.comadminIn scope2026-11-14
origin-dashboard-sand-us-west2.blog.venmo.comadminIn scope2026-11-14
origin-mobileclient-vps-panel-prod.blog.venmo.comadminIn scope2026-11-14
origin-panel.blog.venmo.comadminIn scope2026-11-14
pages-panel-proces.blog.venmo.comadminIn scope2026-11-14
panel-payflowlink.blog.venmo.comadminIn scope2026-11-14
panel-pro.blog.venmo.comadminIn scope2026-11-14
panel-proxy.blog.venmo.comadminIn scope2026-11-14
panel-qa-us-west-1.blog.venmo.comadmin, testIn scope2026-11-14
panet-panel.blog.venmo.comadminIn scope2026-11-14
panet-panel-panel-dev-us-west-2.blog.venmo.comadmin, devIn scope2026-11-14
pilot-coupons-panel.blog.venmo.comadminIn scope2026-11-14
pilot-coupons-panel-dev-us-east-2.blog.venmo.comadmin, devIn scope2026-11-14
pilot-panel-prod-elb.blog.venmo.comadminIn scope2026-11-14
pilot-panel-qa-us-webfconsul-qa-eu-centiv.blog.venmo.comadmin, testIn scope2026-11-14
posprivate-svcs-dashboard-blue-sand-us-east-2.blog.venmo.comadminIn scope2026-11-14
slc-a-origin-posphermes-panel-develope.blog.venmo.comadminIn scope2026-11-14
slc-b-origin-dashboard-blue-front-panel-prod-eu-cent-doorm.blog.venmo.comadminIn scope2026-11-14
slc-b-origin-pointes-panel-qa-us-west.blog.venmo.comadmin, testIn scope2026-11-14
slc-b-origin-posphermes-panel-prod-us-webcons-qa-us-west-1.blog.venmo.comadmin, testIn scope2026-11-14
tes-panetes-panel-proxywebhook-sand-eu-centinel-prod.blog.venmo.comadminIn scope2026-11-14
trinityres-panel-demo.blog.venmo.comadmin, testIn scope2026-11-14
ca-webcons-stagin-blue-svcs-dashboard-sand.venmo.comadminIn scope2026-11-14
cpanel.venmo.comadminIn scope2026-11-14
cxml-xml-xmlapiages-panel-prod-us-west2.venmo.comadminIn scope2026-11-14
disputinel-provisionsul-panel.venmo.comadminIn scope2026-11-14
disputinel-qa-eu-cents-webfcont-panel-prod-us-west.venmo.comadmin, testIn scope2026-11-14
docs-dashboard-qa-origin-prod.venmo.comadmin, testIn scope2026-11-14
dubsiter-panel-swiftfinancopopulatory-1.venmo.comadminIn scope2026-11-14
graphitercarrientegraphiternet-panel.venmo.comadminIn scope2026-11-14
k8s-dashboard-blue-front-data-api.venmo.comadmin, api, toolsIn scope2026-11-14
k8s-dashboard-bluence.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-dev-us-west-2.venmo.comadmin, dev, toolsIn scope2026-11-14
k8s-dashboard-proxywebcons.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-silot-payflowprod-us-east-2.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-silot-raz01-sns.venmo.comadmin, toolsIn scope2026-11-14
k8s-dashboard-simobile-10a.venmo.comadmin, toolsIn scope2026-11-14
kubernet-panel.venmo.comadminIn scope2026-11-14
kubernet-panel-dev-us-web.venmo.comadmin, devIn scope2026-11-14

17,017 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.