Bug bounty program
PI
Picsart
Most upvoted reports1
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| User account compromised authentication bypass via oauth token impersonationAnalysed#739321 | Access Control | 2020-03-20 | – | 101 |
Subdomains1,101
| Name | Scope | First seen |
|---|---|---|
| cms.picsart.studioadmin | Not in the scope | 2026-11-14 |
| cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| cec.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| dashboard.picsart.studioadmin | Not in the scope | 2026-11-14 |
| scalar.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| app-06.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| dwrider.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| tst1lht.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| administrator.picsart.studioadmin | Not in the scope | 2026-11-14 |
| sitsa-ar.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| wremote2.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| z-10-02-admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| auenclave.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| ebaydev04.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| www0-1-31.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| 04-0-2-1-7.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| apimanager.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| uacomtucson.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| web-lab-13.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| advance.stage.cms.picsart.studioadmin, staging | Not in the scope | 2026-11-14 |
| internaltemp.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| snooze9-dashboard.picsart.studioadmin | Not in the scope | 2026-11-14 |
| 02v0-okta-sso.cms1.picsart.studioadmin, auth | Not in the scope | 2026-11-14 |
| 2.snooze9-dashboard.picsart.studioadmin | Not in the scope | 2026-11-14 |
| cms.avs-alexa-13-fe.picsart.studioadmin | Not in the scope | 2026-11-14 |
| ppp2-admin-redirect.picsart.studioadmin | Not in the scope | 2026-11-14 |
| tor307-303-pda.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| tor359-433-grc.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| admetricsclone2admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| subaru-probe-1.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| h-135-207-228-44.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| carry-hawk-ausw2a.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| d2frm-hcm.administrator.picsart.studioadmin | Not in the scope | 2026-11-14 |
| mach131-87-149-96.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| snooze9-dashboard-tpe-f5gtm8.picsart.studioadmin | Not in the scope | 2026-11-14 |
| manual-override-service.admin.picsart.studioadmin | Not in the scope | 2026-11-14 |
| data-user-ns-cmsdb1-origin.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| https-th-m-wikipedia-org84.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
| prod-engine-gke-asia-east1-c-api.cms1.picsart.studioadmin, api | Not in the scope | 2026-11-14 |
| document-management-converter-service.ro.picsart.studioadmin | Not in the scope | 2026-11-14 |
| miembrosdatabase-officebackups-domain.cms1.picsart.studioadmin | Not in the scope | 2026-11-14 |
0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.