Bug bounty program

PayPal

Platform: HackerOne
Bounties: Pays
Assets in scope: 42
Disclosed reports: 13
Subdomains: 17,149
Vendor on CyberSIXT: Paypal (21 CVEs, 0 exploited)

Most upvoted reports13

Most upvoted reports of PayPal
Report	Weakness	Disclosed	Bounty	Votes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152	Injection and Smuggling	2019-08-07	$20,000	2,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737	Authentication	2020-01-08	$15,300	1,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585	Command and Code Injection	2021-02-09	$30,000	946
DoS on PayPal via web cache poisoningAnalysed#622122	Denial of Service	2019-10-23	$9,700	851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081	Insecure Direct Object Reference	2019-07-30	$10,500	797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147	Injection and Smuggling	2019-08-07	$18,900	685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443	Open Redirect	2019-02-07	–	188
[Venmo Android] Remote theft of user sessionAnalysed#401940	Open Redirect	2019-02-07	–	151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835	Cross-site Scripting	2020-05-19	–	137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200	Cross-site Scripting	2018-11-06	–	100

Subdomains17,149

Root:xoom.com

Scope

Name suggests:Development

First seen

Text fileClear filters6 names

Subdomains of PayPal
Name	Scope	First seen
dev-blog.xoom.comdev	In scope	2026-11-14
artifactory.dev.xoom.comdev, tools	In scope	2026-11-14
argo.xm-dev-hub-oma.ord.engtools.xoom.comci, dev	In scope	2026-11-14
argocd.xm-dev-hub-oma.ord.engtools.xoom.comci, dev	In scope	2026-11-14
k8s-api-proxy.xm-dev-hub-oma.ord.engtools.xoom.comapi, dev, tools	In scope	2026-11-14
k8s-api-proxy.xm-dev-xibs-oma.ord.engtools.xoom.comapi, dev, tools	In scope	2026-11-14

17,017 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.