Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
42
Disclosed reports
13
Subdomains
17,149
Vendor on CyberSIXT
Paypal (21 CVEs, 0 exploited)

Most upvoted reports13

All reports
Most upvoted reports of PayPal
ReportWeaknessDisclosedBountyVotes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152Injection and Smuggling2019-08-07$20,0002,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737Authentication2020-01-08$15,3001,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585Command and Code Injection2021-02-09$30,000946
DoS on PayPal via web cache poisoningAnalysed#622122Denial of Service2019-10-23$9,700851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081Insecure Direct Object Reference2019-07-30$10,500797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147Injection and Smuggling2019-08-07$18,900685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443Open Redirect2019-02-07–188
[Venmo Android] Remote theft of user sessionAnalysed#401940Open Redirect2019-02-07–151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835Cross-site Scripting2020-05-19–137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200Cross-site Scripting2018-11-06–100

Subdomains17,149

Subdomains of PayPal
NameScopeFirst seen
atmos-ap-south-posphere-dev-us.venmo.comdevIn scope2026-11-14
basic-nodejs-dev.venmo.comdevIn scope2026-11-14
blue-front-panel-proxywebhook-dev-api.beta.venmo.comadmin, api, dev, stagingIn scope2026-11-14
blue-sale-api-sand-us-webhook-dev-ap-southeast-2.beta.venmo.comapi, dev, stagingIn scope2026-11-14
cascafe-dev-us-westinel-prod.beta.venmo.comdev, stagingIn scope2026-11-14
dev-ap-sand-us-east-2.beta.venmo.comdev, stagingIn scope2026-11-14
dev-us-webfconf.beta.venmo.comdev, stagingIn scope2026-11-14
disputinel-dev-us-east-2.beta.venmo.comdev, stagingIn scope2026-11-14
ementegrafanal-dev-us-east-1.beta.venmo.comdev, stagingIn scope2026-11-14
here-dev-api.beta.venmo.comapi, dev, stagingIn scope2026-11-14
jumpmann-dev-api.beta.venmo.comapi, dev, stagingIn scope2026-11-14
k8s-dashboard-dev.beta.venmo.comadmin, dev, staging, toolsIn scope2026-11-14
k8s-dashboard-dev-api.beta.venmo.comadmin, api, dev, staging, toolsIn scope2026-11-14
k8s-dashboard-dev-us-westvip-b.beta.venmo.comadmin, dev, staging, toolsIn scope2026-11-14
k8s-dev-blue-front-ap-sand-us-west-1.beta.venmo.comdev, staging, toolsIn scope2026-11-14
k8s-dev-us-east-beta.beta.venmo.comdev, staging, toolsIn scope2026-11-14
k8s-dev-us-web.beta.venmo.comdev, staging, toolsIn scope2026-11-14
k8s-dev-us-webserv.beta.venmo.comdev, staging, toolsIn scope2026-11-14
mcf-citroencover-dev-api.beta.venmo.comapi, dev, stagingIn scope2026-11-14
mcf-formancover-dev-api.beta.venmo.comapi, dev, stagingIn scope2026-11-14
mcf-mschreibencover-dev-api.beta.venmo.comapi, dev, stagingIn scope2026-11-14
mcf-novenyekazotthonodbancover-dev-api.beta.venmo.comapi, dev, stagingIn scope2026-11-14
mcf-stilexpertencover-dev-api.beta.venmo.comapi, dev, stagingIn scope2026-11-14
nagdashboard-dev-us-east-doormserver.beta.venmo.comdev, stagingIn scope2026-11-14
ops-panel-dev-us-websitestcr.beta.venmo.comadmin, dev, stagingIn scope2026-11-14
origin-arbites-prod-us-webfconf-dev-us-east-2.beta.venmo.comdev, stagingIn scope2026-11-14
origin-dev-us-west-2.beta.venmo.comdev, stagingIn scope2026-11-14
pamhook-dev-us-east-2.beta.venmo.comdev, stagingIn scope2026-11-14
pamhook-dev-us-west-2.beta.venmo.comdev, stagingIn scope2026-11-14
pilot-coupons-panel-dev-us-east-2.beta.venmo.comadmin, dev, stagingIn scope2026-11-14
reportal-dev-us-webhook-qa-ad.beta.venmo.comdev, staging, testIn scope2026-11-14
secure-dev-us-west-1.beta.venmo.comdev, stagingIn scope2026-11-14
sefcu-dev-ap-southeast-door-prod-elb.beta.venmo.comdev, stagingIn scope2026-11-14
supportinel-dev-us-west-2.beta.venmo.comdev, stagingIn scope2026-11-14
trand-us-webhook-dev-us-east-2.beta.venmo.comdev, stagingIn scope2026-11-14
vcs-dev-us-webconsul-prod-us-east-2.beta.venmo.comdev, stagingIn scope2026-11-14
atmosphere-dev-us-east-2.blog.venmo.comdevIn scope2026-11-14
autodisputinel-developer-dev-us-east-1.blog.venmo.comdevIn scope2026-11-14
cdn-dev-us-west.blog.venmo.comdevIn scope2026-11-14
cf-cdncover-dev-api.blog.venmo.comapi, devIn scope2026-11-14
cf-market-force-informationcover-dev-api.blog.venmo.comapi, devIn scope2026-11-14
cf-matlvpncover-dev-api.blog.venmo.comapi, devIn scope2026-11-14
cf-mobileclientransactioncover-dev-api.blog.venmo.comapi, devIn scope2026-11-14
cf-mspecnazspncover-dev-api.blog.venmo.comapi, devIn scope2026-11-14
cf-mtrinincover-dev-api.blog.venmo.comapi, devIn scope2026-11-14
cf-mvisioncover-dev-api.blog.venmo.comapi, devIn scope2026-11-14
cf-origin-histransactioncover-dev-api.blog.venmo.comapi, devIn scope2026-11-14
chd-origin-posphere-dev.blog.venmo.comdevIn scope2026-11-14
dcg12-origin-dev.blog.venmo.comdevIn scope2026-11-14
dev-ap-sand-us-east-2.blog.venmo.comdevIn scope2026-11-14
dev-us-easter.blog.venmo.comdevIn scope2026-11-14
dev-us-eu-cent-test-1.blog.venmo.comdev, testIn scope2026-11-14
jumpmann-dev-api.blog.venmo.comapi, devIn scope2026-11-14
k8s-dashboard-dev-us-webconf.blog.venmo.comadmin, dev, toolsIn scope2026-11-14
k8s-dev-ap-southy.blog.venmo.comdev, toolsIn scope2026-11-14
k8s-dev-app.blog.venmo.comdev, toolsIn scope2026-11-14
k8s-dev-blue-front-panet-panvpn-analytic.blog.venmo.comdev, toolsIn scope2026-11-14
mobile-dev-us-westinel-promotion-disputing.blog.venmo.comdevIn scope2026-11-14
origin-arbites-prod-us-webfconf-dev-us-east-2.blog.venmo.comdevIn scope2026-11-14
origin-dev-us-east-2.blog.venmo.comdevIn scope2026-11-14
origin-qa-eu-centinel-demo-cdn-dev-us-webcons-paypal01.blog.venmo.comdev, testIn scope2026-11-14
pamhook-dev-us-west-2.blog.venmo.comdevIn scope2026-11-14
panet-panel-panel-dev-us-west-2.blog.venmo.comadmin, devIn scope2026-11-14
partinel-dev-us-east-2-prod-silot-cosmosphere-sand.blog.venmo.comdevIn scope2026-11-14
phx-origin-mobile-dev-us-east-ipnpb-1.blog.venmo.comdevIn scope2026-11-14
pilot-coupons-panel-dev-us-east-2.blog.venmo.comadmin, devIn scope2026-11-14
pointercard-dev-api2-svcs-qa-us-westvip.blog.venmo.comapi, dev, testIn scope2026-11-14
reportification-econt-door-dev-api.blog.venmo.comapi, devIn scope2026-11-14
sefcu-dev-ap-southeast-door-prod-elb.blog.venmo.comdevIn scope2026-11-14
supportinel-dev-us-west-2.blog.venmo.comdevIn scope2026-11-14
tokenizer-dev-us-east-2.blog.venmo.comdevIn scope2026-11-14
cdn-dev-us-eu-cents.venmo.comdevIn scope2026-11-14
cdn-dev-us-west.venmo.comdevIn scope2026-11-14
cf-aomparpssorncover-dev-api.venmo.comapi, devIn scope2026-11-14
cf-danskeksamencover-dev-api.venmo.comapi, devIn scope2026-11-14
cf-dokkan-dokkancover-dev-api.venmo.comapi, devIn scope2026-11-14
cf-mpilot-campaigncover-dev-api.venmo.comapi, devIn scope2026-11-14
cim-api-dev.venmo.comapi, devIn scope2026-11-14
cim-dev.venmo.comdevIn scope2026-11-14
cim-geo-dev.venmo.comdevIn scope2026-11-14
dev.venmo.comdevIn scope2026-11-14
dev-ap-sand-us-east-2.venmo.comdevIn scope2026-11-14
dev-us-webfconf.venmo.comdevIn scope2026-11-14
dev-us-webhook-qa-origin-proxy.venmo.comdev, testIn scope2026-11-14
api.dev.venmo.comapi, devIn scope2026-11-14
scope.dev.venmo.comdevIn scope2026-11-14
docs-dev-us-west2.venmo.comdevIn scope2026-11-14
dogfood-dev.venmo.comdevIn scope2026-11-14
gcom-product-find-dev.venmo.comdevIn scope2026-11-14
gws-dev.venmo.comdevIn scope2026-11-14
jumpmanal-dev-us-web.venmo.comdevIn scope2026-11-14
jumpmann-dev-us-east-2.venmo.comdevIn scope2026-11-14
k8s-dashboard-dev-us-west-2.venmo.comadmin, dev, toolsIn scope2026-11-14
k8s-dev-app.venmo.comdev, toolsIn scope2026-11-14
k8s-dev-us-east-2.venmo.comdev, toolsIn scope2026-11-14
k8s-dev-us-webserv.venmo.comdev, toolsIn scope2026-11-14
kuberchantwebhook-dev.venmo.comdevIn scope2026-11-14
kubernet-panel-dev-us-web.venmo.comadmin, devIn scope2026-11-14
dev.live.venmo.comdevIn scope2026-11-14
account.dev.live.venmo.comdevIn scope2026-11-14

17,017 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.