Bug bounty program
PI
pixiv
Most upvoted reports14
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Reset any passwordAnalysed#703972 | Authentication | 2021-03-31 | – | 313 |
| Stealing Users OAuth authorization code via redirect_uriAnalysed#1861974 | Access Control | 2023-03-22 | $2,000 | 253 |
| Disclose Hidden Comments on Media Section of hub.vroid.comAnalysed#2541962 | Insecure Direct Object Reference | 2026-01-18 | $500 | 149 |
| Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}Analysed#2473173 | Information Disclosure | 2026-01-20 | – | 145 |
| XSS reflected on [https://www.pixiv.net]Analysed#766633 | Cross-site Scripting | 2020-12-17 | $500 | 144 |
| Non-premium user can disable Ads in japanese version of dic.pixiv.netAnalysed#3183520 | Input Validation and Logic | 2026-04-27 | $3,000 | 123 |
| clickjacing can lead to account takeoverAnalysed#2119892 | Misconfiguration and Insecure Design | 2026-01-18 | $200 | 70 |
| XSS Reflected at https://sketch.pixiv.net/ Via `next_url`Analysed#1503601 | Cross-site Scripting | 2022-03-23 | – | 64 |
| Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.netAnalysed#3100570 | Access Control | 2026-04-27 | – | 53 |
| RCE due to ImageTragick v2Analysed#402362 | Command and Code Injection | 2021-03-16 | $2,000 | 44 |
Subdomains117,017
| Name | Scope | First seen |
|---|---|---|
| demo.booth.pmtest | Not in the scope | 2026-11-14 |
| test.booth.pmtest | Not in the scope | 2026-11-14 |
| cim-qa.booth.pmtest | Not in the scope | 2026-11-14 |
| gws-qa.booth.pmtest | Not in the scope | 2026-11-14 |
| cim-uat.booth.pmtest | Not in the scope | 2026-11-14 |
| gws-uat.booth.pmtest | Not in the scope | 2026-11-14 |
| h1test1.booth.pmtest | Not in the scope | 2026-11-14 |
| sandbox.booth.pmtest | Not in the scope | 2026-11-14 |
| test2345.booth.pmtest | Not in the scope | 2026-11-14 |
| ccc-test2.booth.pmtest | Not in the scope | 2026-11-14 |
| cim-api-qa.booth.pmapi, test | Not in the scope | 2026-11-14 |
| jagey-test.booth.pmtest | Not in the scope | 2026-11-14 |
| kukui-test.booth.pmtest | Not in the scope | 2026-11-14 |
| akamai-test.booth.pmtest | Not in the scope | 2026-11-14 |
| cim-api-uat.booth.pmapi, test | Not in the scope | 2026-11-14 |
| demo-freaks.booth.pmtest | Not in the scope | 2026-11-14 |
| test123test.booth.pmtest | Not in the scope | 2026-11-14 |
| test20201106.booth.pmtest | Not in the scope | 2026-11-14 |
| cim-service-qa.booth.pmtest | Not in the scope | 2026-11-14 |
| marshmallow-qa.booth.pmtest | Not in the scope | 2026-11-14 |
| cim-service-uat.booth.pmtest | Not in the scope | 2026-11-14 |
| gws-api-sandbox.booth.pmapi, test | Not in the scope | 2026-11-14 |
| retrovirus-test.booth.pmtest | Not in the scope | 2026-11-14 |
| searchportal-qa.booth.pmtest | Not in the scope | 2026-11-14 |
| test.retrovirus.booth.pmtest | Not in the scope | 2026-11-14 |
| security-testing.booth.pmtest | Not in the scope | 2026-11-14 |
| akamai-test-origin.booth.pmtest | Not in the scope | 2026-11-14 |
| cim-data-quality-qa.booth.pmtest | Not in the scope | 2026-11-14 |
| gcom-product-find-qa.booth.pmtest | Not in the scope | 2026-11-14 |
| gws-rds-external-readonly-uat.booth.pmtest | Not in the scope | 2026-11-14 |
| konoiz-test.www.pixiv.nettest | Not in the scope | 2026-11-14 |
11 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.