Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
42
Disclosed reports
13
Subdomains
17,149
Vendor on CyberSIXT
Paypal (21 CVEs, 0 exploited)

Most upvoted reports13

All reports
Most upvoted reports of PayPal
ReportWeaknessDisclosedBountyVotes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152Injection and Smuggling2019-08-07$20,0002,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737Authentication2020-01-08$15,3001,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585Command and Code Injection2021-02-09$30,000946
DoS on PayPal via web cache poisoningAnalysed#622122Denial of Service2019-10-23$9,700851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081Insecure Direct Object Reference2019-07-30$10,500797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147Injection and Smuggling2019-08-07$18,900685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443Open Redirect2019-02-07–188
[Venmo Android] Remote theft of user sessionAnalysed#401940Open Redirect2019-02-07–151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835Cross-site Scripting2020-05-19–137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200Cross-site Scripting2018-11-06–100

Subdomains17,149

Subdomains of PayPal
NameScopeFirst seen
accouponsul-qa-us-west-2.venmo.comtestIn scope2026-11-14
advertifications-qa-us-east-2.venmo.comtestIn scope2026-11-14
akamai-test.venmo.comtestIn scope2026-11-14
akamai-test-origin.venmo.comtestIn scope2026-11-14
atmgate-qa-api.venmo.comapi, testIn scope2026-11-14
atmosphere-qa-eu-centofsale-apply.venmo.comtestIn scope2026-11-14
atmosphere-qa-us-east-2.venmo.comtestIn scope2026-11-14
atmosphere-sand-eu-cent-tes-panet-panel-qa-eu.venmo.comadmin, testIn scope2026-11-14
atmosphermes-panel-qa-eu-centegrafanal-1.venmo.comadmin, testIn scope2026-11-14
atmosprivate-qa-us-west-2.venmo.comtestIn scope2026-11-14
autodiscover-couponsul-provisa-coupons-qa-us-west-2.venmo.commail, testIn scope2026-11-14
autodisputin-posphere-qa-origin-posprivatevpn-api-proxy.venmo.comapi, testIn scope2026-11-14
accouponsul-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
appme-origin-posphere-qa-ap-sand-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
atmgate-qa-api.beta.venmo.comapi, staging, testIn scope2026-11-14
atmosphere-qa-us-east-ipnpb-1.beta.venmo.comstaging, testIn scope2026-11-14
atmosphere-qa-us-web.beta.venmo.comstaging, testIn scope2026-11-14
atmosphere-sand-eu-cent-tes-panet-panel-qa-eu.beta.venmo.comadmin, staging, testIn scope2026-11-14
atmosprivate-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
blueprivate-qa-us-westvip.beta.venmo.comstaging, testIn scope2026-11-14
bransactionsul-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
businel-qa.beta.venmo.comstaging, testIn scope2026-11-14
businel-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
businel-qa-us-eu-centinel.beta.venmo.comstaging, testIn scope2026-11-14
chd-origin-disputin-applications-qa-us-west.beta.venmo.comstaging, testIn scope2026-11-14
clicationsul-qa-eu-centercard-qa-airflowlinks.beta.venmo.comstaging, testIn scope2026-11-14
clients-qa-origin-histransactiv-dft.beta.venmo.comstaging, testIn scope2026-11-14
consul-swith-posphere-demo.beta.venmo.comstaging, test, toolsIn scope2026-11-14
cosmosphere-qa-us-west.beta.venmo.comstaging, testIn scope2026-11-14
cybernetestinel-qa.beta.venmo.comstaging, testIn scope2026-11-14
dcg02-origin-svcs-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
demo.beta.venmo.comstaging, testIn scope2026-11-14
discopopulator-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
disputil-sandbox-simulator9.beta.venmo.comstaging, testIn scope2026-11-14
docker-paypal-demo2.beta.venmo.comstaging, test, toolsIn scope2026-11-14
docs-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
docs-qa-us-west.beta.venmo.comstaging, testIn scope2026-11-14
docs-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
eure-qa.beta.venmo.comstaging, testIn scope2026-11-14
fat-test.beta.venmo.comstaging, testIn scope2026-11-14
graphiter-qa-us-east-1.beta.venmo.comstaging, testIn scope2026-11-14
k8s-dasha2-test.beta.venmo.comstaging, test, toolsIn scope2026-11-14
lvs1webconsul-swificationsul-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
mercarrientinel-qa-us-west-analytic-ipnpb-1.beta.venmo.comstaging, testIn scope2026-11-14
merchant-door-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
notionsul-qa-api.beta.venmo.comapi, staging, testIn scope2026-11-14
notionsul-qa-us-westvip-b.beta.venmo.comstaging, testIn scope2026-11-14
origin-atmosphere-qa-us-east-1.beta.venmo.comstaging, testIn scope2026-11-14
origin-coupons-qa-us-websitesting.beta.venmo.comstaging, testIn scope2026-11-14
origin-posphere-qa-us-webserver.beta.venmo.comstaging, testIn scope2026-11-14
origin-posphere-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
pamhook-demo.beta.venmo.comstaging, testIn scope2026-11-14
pamhook-rector-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
pamhook-sandbox1.beta.venmo.comstaging, testIn scope2026-11-14
panel-qa-us-west-1.beta.venmo.comadmin, staging, testIn scope2026-11-14
panel-qa-us-west-door-us-webconf.beta.venmo.comadmin, staging, testIn scope2026-11-14
panvpn-svcs-qa-us-east-ipnpb-1.beta.venmo.comstaging, testIn scope2026-11-14
pay-sessor-qa-us-easterror.beta.venmo.comstaging, testIn scope2026-11-14
payat-door-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
payat-test.beta.venmo.comstaging, testIn scope2026-11-14
payat-test-1.beta.venmo.comstaging, testIn scope2026-11-14
phx-origin-histrations-panel-qa-us-east-2.beta.venmo.comadmin, staging, testIn scope2026-11-14
pilot-coupons-qa-us-east-1.beta.venmo.comstaging, testIn scope2026-11-14
pointory-qa-us-east-1.beta.venmo.comstaging, testIn scope2026-11-14
portificationsul-qa.beta.venmo.comstaging, testIn scope2026-11-14
posphere-qa-us-east-2-prod.beta.venmo.comstaging, testIn scope2026-11-14
posphere-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
posprivate-qa-us-west-1.beta.venmo.comstaging, testIn scope2026-11-14
prod-eu-centrationsul-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
reportal-dev-us-webhook-qa-ad.beta.venmo.comdev, staging, testIn scope2026-11-14
sefcu-webcons-qa-eu-cents.beta.venmo.comstaging, testIn scope2026-11-14
sefcu-webhook-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
sentes-simulataskworker-couponsul-qa-us-eu-cent-1.beta.venmo.comstaging, testIn scope2026-11-14
sentinel-qa-origin-coundecisinel-prod-us-west2.beta.venmo.comstaging, testIn scope2026-11-14
sents-qa-api.beta.venmo.comapi, staging, testIn scope2026-11-14
sha2-test-2.beta.venmo.comstaging, testIn scope2026-11-14
sjc-walmartisions-qa-us-webserv.beta.venmo.comstaging, testIn scope2026-11-14
slc-a-origin-posphere-qa-api.beta.venmo.comapi, staging, testIn scope2026-11-14
slc-a-origin-posprivate-qa-us-west-2.beta.venmo.comstaging, testIn scope2026-11-14
slc-a-origin-qa-eu-centive-c.beta.venmo.comstaging, testIn scope2026-11-14
slc-a-origin-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
slc-b-origin-mediaprod-eu-cent-test-2.beta.venmo.comstaging, testIn scope2026-11-14
slc-b-origin-mobileclients-test-2.beta.venmo.comstaging, testIn scope2026-11-14
slc-b-origin-pointegrations-panel-qa-eu-cent-panet.beta.venmo.comadmin, staging, testIn scope2026-11-14
slc-b-origin-pointegrationsul-qa.beta.venmo.comstaging, testIn scope2026-11-14
slc-b-origin-posphere-qa-us-east-1.beta.venmo.comstaging, testIn scope2026-11-14
slc-b-origin-qa-us-west2.beta.venmo.comstaging, testIn scope2026-11-14
stagin-histor-qa-us-east-2.beta.venmo.comstaging, testIn scope2026-11-14
stagin-qa-eu-centegrationsul-swificationsul-proxywebserv.beta.venmo.comstaging, testIn scope2026-11-14
svcs-qa-us-west2.beta.venmo.comstaging, testIn scope2026-11-14
test-2.beta.venmo.comstaging, testIn scope2026-11-14
transactive-histreensionsul-prod-sandbox-silot-xlm-reg.beta.venmo.comstaging, testIn scope2026-11-14
trinitor-qa-us-west.beta.venmo.comstaging, testIn scope2026-11-14
uat-test-2.beta.venmo.comstaging, testIn scope2026-11-14
uat-zebransactiv.beta.venmo.comstaging, testIn scope2026-11-14
53-dc6-sslvpn-svcs-qa-us-west.blog.venmo.comtest, vpnIn scope2026-11-14
accouponsul-qa-us-west-2.blog.venmo.comtestIn scope2026-11-14
atl-uat-testatevpn-sand.blog.venmo.comtestIn scope2026-11-14
atmosphere-qa-us-web.blog.venmo.comtestIn scope2026-11-14
autodisputin-posphere-qa-origin-posprivatevpn-api-proxy.blog.venmo.comapi, testIn scope2026-11-14

17,017 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.