Skip to content
Connect AISign inSign up free

Bug bounty program

PI

pixiv

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
18
Disclosed reports
14
Subdomains
117,017

Most upvoted reports14

All reports
Most upvoted reports of pixiv
ReportWeaknessDisclosedBountyVotes
Reset any passwordAnalysed#703972Authentication2021-03-31–313
Stealing Users OAuth authorization code via redirect_uriAnalysed#1861974Access Control2023-03-22$2,000253
Disclose Hidden Comments on Media Section of hub.vroid.comAnalysed#2541962Insecure Direct Object Reference2026-01-18$500149
Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}Analysed#2473173Information Disclosure2026-01-20–145
XSS reflected on [https://www.pixiv.net]Analysed#766633Cross-site Scripting2020-12-17$500144
Non-premium user can disable Ads in japanese version of dic.pixiv.netAnalysed#3183520Input Validation and Logic2026-04-27$3,000123
clickjacing can lead to account takeoverAnalysed#2119892Misconfiguration and Insecure Design2026-01-18$20070
XSS Reflected at https://sketch.pixiv.net/ Via `next_url`Analysed#1503601Cross-site Scripting2022-03-23–64
Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.netAnalysed#3100570Access Control2026-04-27–53
RCE due to ImageTragick v2Analysed#402362Command and Code Injection2021-03-16$2,00044

Subdomains117,017

Root
Scope
Name suggests
First seen
Text file117,017 names
Subdomains of pixiv
NameScopeFirst seen
0139.booth.pmNot in the scope2026-11-14
0141029.booth.pmNot in the scope2026-11-14
0141938.booth.pmNot in the scope2026-11-14
0141moonjelly.booth.pmNot in the scope2026-11-14
0141sabacan.booth.pmNot in the scope2026-11-14
0141soup.booth.pmNot in the scope2026-11-14
014mesi.booth.pmNot in the scope2026-11-14
0151-hitsuji.booth.pmNot in the scope2026-11-14
015iso.booth.pmNot in the scope2026-11-14
015world.booth.pmNot in the scope2026-11-14
016.booth.pmNot in the scope2026-11-14
01639.booth.pmNot in the scope2026-11-14
0176.booth.pmNot in the scope2026-11-14
017f.booth.pmNot in the scope2026-11-14
017lio.booth.pmNot in the scope2026-11-14
01ch.booth.pmNot in the scope2026-11-14
01d.booth.pmNot in the scope2026-11-14
01garou.booth.pmNot in the scope2026-11-14
01image.booth.pmNot in the scope2026-11-14
01metoro.booth.pmNot in the scope2026-11-14
01no38.booth.pmNot in the scope2026-11-14
01rei.booth.pmNot in the scope2026-11-14
01salt01.booth.pmNot in the scope2026-11-14
01samici.booth.pmNot in the scope2026-11-14
01ssmi.booth.pmNot in the scope2026-11-14
01touka.booth.pmNot in the scope2026-11-14
0208.booth.pmNot in the scope2026-11-14
0208cream.booth.pmNot in the scope2026-11-14
0216kyo.booth.pmNot in the scope2026-11-14
0222.booth.pmNot in the scope2026-11-14
0230design.booth.pmNot in the scope2026-11-14
02311201.booth.pmNot in the scope2026-11-14
025x3104.booth.pmNot in the scope2026-11-14
026-0717.booth.pmNot in the scope2026-11-14
026910.booth.pmNot in the scope2026-11-14
026nyao.booth.pmNot in the scope2026-11-14
026umi.booth.pmNot in the scope2026-11-14
0273.booth.pmNot in the scope2026-11-14
02931317.booth.pmNot in the scope2026-11-14
029products.booth.pmNot in the scope2026-11-14
029uma1.booth.pmNot in the scope2026-11-14
02desu.booth.pmNot in the scope2026-11-14
02f.booth.pmNot in the scope2026-11-14
02febru.booth.pmNot in the scope2026-11-14
02market.booth.pmNot in the scope2026-11-14
02oka.booth.pmNot in the scope2026-11-14
02r01638e02.booth.pmNot in the scope2026-11-14
02shinichi.booth.pmNot in the scope2026-11-14
02task1k9.booth.pmNot in the scope2026-11-14
02tubaki.booth.pmNot in the scope2026-11-14
02x.booth.pmNot in the scope2026-11-14
030.booth.pmNot in the scope2026-11-14
0302.booth.pmNot in the scope2026-11-14
0313.booth.pmNot in the scope2026-11-14
0315.booth.pmNot in the scope2026-11-14
032.booth.pmNot in the scope2026-11-14
03221215.booth.pmNot in the scope2026-11-14
0324.booth.pmNot in the scope2026-11-14
0324tuhan.booth.pmNot in the scope2026-11-14
0326mi.booth.pmNot in the scope2026-11-14
032e.booth.pmNot in the scope2026-11-14
0331kappa.booth.pmNot in the scope2026-11-14
0335.booth.pmNot in the scope2026-11-14
0364.booth.pmNot in the scope2026-11-14
036honey.booth.pmNot in the scope2026-11-14
036no912.booth.pmNot in the scope2026-11-14
036yng.booth.pmNot in the scope2026-11-14
037.booth.pmNot in the scope2026-11-14
0371stellium.booth.pmNot in the scope2026-11-14
03endr0ll.booth.pmNot in the scope2026-11-14
03sara.booth.pmNot in the scope2026-11-14
03sasa03.booth.pmNot in the scope2026-11-14
03yousei-ao.booth.pmNot in the scope2026-11-14
04170518.booth.pmNot in the scope2026-11-14
0420ouka.booth.pmNot in the scope2026-11-14
0423seido.booth.pmNot in the scope2026-11-14
0428-doughnut.booth.pmNot in the scope2026-11-14
0428-shop.booth.pmNot in the scope2026-11-14
043.booth.pmNot in the scope2026-11-14
0430chiya.booth.pmNot in the scope2026-11-14
043strawberry.booth.pmNot in the scope2026-11-14
04440.booth.pmNot in the scope2026-11-14
045o45045.booth.pmNot in the scope2026-11-14
048840.booth.pmNot in the scope2026-11-14
049sakana.booth.pmNot in the scope2026-11-14
04cahetel27.booth.pmNot in the scope2026-11-14
04cura.booth.pmNot in the scope2026-11-14
04m-k-k-s19.booth.pmNot in the scope2026-11-14
04matsuko.booth.pmNot in the scope2026-11-14
04q.booth.pmNot in the scope2026-11-14
04satsuki.booth.pmNot in the scope2026-11-14
0506x0812.booth.pmNot in the scope2026-11-14
0508madaramoyou.booth.pmNot in the scope2026-11-14
0508maisousaku.booth.pmNot in the scope2026-11-14
050off.booth.pmNot in the scope2026-11-14
0512uni.booth.pmNot in the scope2026-11-14
0517.booth.pmNot in the scope2026-11-14
0520vacation.booth.pmNot in the scope2026-11-14
0523hidamaru.booth.pmNot in the scope2026-11-14
05260320.booth.pmNot in the scope2026-11-14

11 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated