Bug bounty program · HackerOne
Most upvoted reports14
- #703972ValidAnalysedReset any passwordpixiv · Authentication · 2021 · needs: no account · Password reset flaw, Account takeover chain, Missing rate limit–313votes
- #1861974ValidStealing Users OAuth authorization code via redirect_uripixiv · Access Control · 2023$2,000253votes
- #2541962ValidDisclose Hidden Comments on Media Section of hub.vroid.compixiv · Insecure Direct Object Reference · 2026 · Medium$500149votes
- #2473173ValidInternal logs/info leaked via endpoint {https://203.137.128.240/server-status}pixiv · Information Disclosure · 2026 · High–145votes
- #766633ValidXSS reflected on [https://www.pixiv.net]pixiv · Cross-site Scripting · 2020$500144votes
- #3183520ValidNon-premium user can disable Ads in japanese version of dic.pixiv.netpixiv · Input Validation and Logic · 2026 · High$3,000123votes
- #2119892Validclickjacing can lead to account takeoverpixiv · Misconfiguration and Insecure Design · 2026 · Low$20070votes
- #1503601ValidXSS Reflected at https://sketch.pixiv.net/ Via `next_url`pixiv · Cross-site Scripting · 2022–64votes
- #3100570ValidBypassing Inbox Privacy Settings and Enabling Spam on Pixiv.netpixiv · Access Control · 2026 · Low–53votes
- #402362ValidRCE due to ImageTragick v2pixiv · Command and Code Injection · 2021$2,00044votes
Subdomains117,017
11 covered by the program's own scope · 0 first seen this week
117,017 names
| Name | Scope | First seen |
|---|---|---|
| 0---444---0.booth.pm | Not in the scope | 2026-11-14 |
| 0-03.booth.pm | Not in the scope | 2026-11-14 |
| 0-0t--k.booth.pm | Not in the scope | 2026-11-14 |
| 0-birth-creation.booth.pm | Not in the scope | 2026-11-14 |
| 0-blender.booth.pm | Not in the scope | 2026-11-14 |
| 0-gravitystudio.booth.pm | Not in the scope | 2026-11-14 |
| 0-inklude-0.booth.pm | Not in the scope | 2026-11-14 |
| 0-izayoi.booth.pm | Not in the scope | 2026-11-14 |
| 0-topia.booth.pm | Not in the scope | 2026-11-14 |
| 00-yz-00.booth.pm | Not in the scope | 2026-11-14 |
| 00-zumi.booth.pm | Not in the scope | 2026-11-14 |
| 000.booth.pm | Not in the scope | 2026-11-14 |
| 0000000.booth.pm | Not in the scope | 2026-11-14 |
| 0000000000.booth.pm | Not in the scope | 2026-11-14 |
| 000000005.booth.pm | Not in the scope | 2026-11-14 |
| 00000000black.booth.pm | Not in the scope | 2026-11-14 |
| 0000000maru.booth.pm | Not in the scope | 2026-11-14 |
| 0000box.booth.pm | Not in the scope | 2026-11-14 |
| 0000k.booth.pm | Not in the scope | 2026-11-14 |
| 00011.booth.pm | Not in the scope | 2026-11-14 |
| 00017.booth.pm | Not in the scope | 2026-11-14 |
| 0001aoisora.booth.pm | Not in the scope | 2026-11-14 |
| 0001cacao.booth.pm | Not in the scope | 2026-11-14 |
| 0001tsuitachi.booth.pm | Not in the scope | 2026-11-14 |
| 000222.booth.pm | Not in the scope | 2026-11-14 |
| 000elegy000.booth.pm | Not in the scope | 2026-11-14 |
| 000hoi.booth.pm | Not in the scope | 2026-11-14 |
| 000khz.booth.pm | Not in the scope | 2026-11-14 |
| 000sea-orca.booth.pm | Not in the scope | 2026-11-14 |
| 000strawberry000.booth.pm | Not in the scope | 2026-11-14 |
| 000swallow000.booth.pm | Not in the scope | 2026-11-14 |
| 001-blast.booth.pm | Not in the scope | 2026-11-14 |
| 0017.booth.pm | Not in the scope | 2026-11-14 |
| 0017ch.booth.pm | Not in the scope | 2026-11-14 |
| 00217.booth.pm | Not in the scope | 2026-11-14 |
| 0027tmgk.booth.pm | Not in the scope | 2026-11-14 |
| 002psy.booth.pm | Not in the scope | 2026-11-14 |
| 0032.booth.pm | Not in the scope | 2026-11-14 |
| 00323z.booth.pm | Not in the scope | 2026-11-14 |
| 0033.booth.pm | Not in the scope | 2026-11-14 |
| 004646.booth.pm | Not in the scope | 2026-11-14 |
| 00469600.booth.pm | Not in the scope | 2026-11-14 |
| 004ynasushop.booth.pm | Not in the scope | 2026-11-14 |
| 00507689.booth.pm | Not in the scope | 2026-11-14 |
| 005fff.booth.pm | Not in the scope | 2026-11-14 |
| 005harry.booth.pm | Not in the scope | 2026-11-14 |
| 007-tekino-359.booth.pm | Not in the scope | 2026-11-14 |
| 0079-0083-1093.booth.pm | Not in the scope | 2026-11-14 |
| 007f89siyo.booth.pm | Not in the scope | 2026-11-14 |
| 008.booth.pm | Not in the scope | 2026-11-14 |
| 00alphard00.booth.pm | Not in the scope | 2026-11-14 |
| 00asakareia00.booth.pm | Not in the scope | 2026-11-14 |
| 00buta-bako00.booth.pm | Not in the scope | 2026-11-14 |
| 00ff.booth.pm | Not in the scope | 2026-11-14 |
| 00ffff.booth.pm | Not in the scope | 2026-11-14 |
| 00fool.booth.pm | Not in the scope | 2026-11-14 |
| 00gi.booth.pm | Not in the scope | 2026-11-14 |
| 00hao00.booth.pm | Not in the scope | 2026-11-14 |
| 00kanoyooo.booth.pm | Not in the scope | 2026-11-14 |
| 00larimarsray.booth.pm | Not in the scope | 2026-11-14 |
| 00mataashita00.booth.pm | Not in the scope | 2026-11-14 |
| 00meiko1105.booth.pm | Not in the scope | 2026-11-14 |
| 00mizuno00e.booth.pm | Not in the scope | 2026-11-14 |
| 00molly.booth.pm | Not in the scope | 2026-11-14 |
| 00mutumi.booth.pm | Not in the scope | 2026-11-14 |
| 00namuya.booth.pm | Not in the scope | 2026-11-14 |
| 00nimo00.booth.pm | Not in the scope | 2026-11-14 |
| 00peke.booth.pm | Not in the scope | 2026-11-14 |
| 00red.booth.pm | Not in the scope | 2026-11-14 |
| 00rose00.booth.pm | Not in the scope | 2026-11-14 |
| 00sakky00.booth.pm | Not in the scope | 2026-11-14 |
| 00snowflake00.booth.pm | Not in the scope | 2026-11-14 |
| 00sora00.booth.pm | Not in the scope | 2026-11-14 |
| 00wunderkammer00.booth.pm | Not in the scope | 2026-11-14 |
| 00zealot.booth.pm | Not in the scope | 2026-11-14 |
| 010.booth.pm | Not in the scope | 2026-11-14 |
| 010-leitouko.booth.pm | Not in the scope | 2026-11-14 |
| 01000.booth.pm | Not in the scope | 2026-11-14 |
| 01000gmgk.booth.pm | Not in the scope | 2026-11-14 |
| 0101831.booth.pm | Not in the scope | 2026-11-14 |
| 0102-xxx-1020.booth.pm | Not in the scope | 2026-11-14 |
| 0102ichi.booth.pm | Not in the scope | 2026-11-14 |
| 0103.booth.pm | Not in the scope | 2026-11-14 |
| 0108aramode.booth.pm | Not in the scope | 2026-11-14 |
| 0108mizunosoko.booth.pm | Not in the scope | 2026-11-14 |
| 010flamingo.booth.pm | Not in the scope | 2026-11-14 |
| 010luto.booth.pm | Not in the scope | 2026-11-14 |
| 010s20.booth.pm | Not in the scope | 2026-11-14 |
| 010toreko.booth.pm | Not in the scope | 2026-11-14 |
| 0112khz.booth.pm | Not in the scope | 2026-11-14 |
| 0113--akira.booth.pm | Not in the scope | 2026-11-14 |
| 01135box.booth.pm | Not in the scope | 2026-11-14 |
| 0115kurumi.booth.pm | Not in the scope | 2026-11-14 |
| 012.booth.pm | Not in the scope | 2026-11-14 |
| 0120-217-217.booth.pm | Not in the scope | 2026-11-14 |
| 012015.booth.pm | Not in the scope | 2026-11-14 |
| 01204.booth.pm | Not in the scope | 2026-11-14 |
| 0123.booth.pm | Not in the scope | 2026-11-14 |
| 0125zabeo.booth.pm | Not in the scope | 2026-11-14 |
| 0130merci.booth.pm | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.