Bug bounty program
PI
pixiv
Most upvoted reports14
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Reset any passwordAnalysed#703972 | Authentication | 2021-03-31 | – | 313 |
| Stealing Users OAuth authorization code via redirect_uriAnalysed#1861974 | Access Control | 2023-03-22 | $2,000 | 253 |
| Disclose Hidden Comments on Media Section of hub.vroid.comAnalysed#2541962 | Insecure Direct Object Reference | 2026-01-18 | $500 | 149 |
| Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}Analysed#2473173 | Information Disclosure | 2026-01-20 | – | 145 |
| XSS reflected on [https://www.pixiv.net]Analysed#766633 | Cross-site Scripting | 2020-12-17 | $500 | 144 |
| Non-premium user can disable Ads in japanese version of dic.pixiv.netAnalysed#3183520 | Input Validation and Logic | 2026-04-27 | $3,000 | 123 |
| clickjacing can lead to account takeoverAnalysed#2119892 | Misconfiguration and Insecure Design | 2026-01-18 | $200 | 70 |
| XSS Reflected at https://sketch.pixiv.net/ Via `next_url`Analysed#1503601 | Cross-site Scripting | 2022-03-23 | – | 64 |
| Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.netAnalysed#3100570 | Access Control | 2026-04-27 | – | 53 |
| RCE due to ImageTragick v2Analysed#402362 | Command and Code Injection | 2021-03-16 | $2,000 | 44 |
Subdomains117,017
| Name | Scope | First seen |
|---|---|---|
| k8s.booth.pmtools | Not in the scope | 2026-11-14 |
| wiki.booth.pmtools | Not in the scope | 2026-11-14 |
| vault.booth.pmtools | Not in the scope | 2026-11-14 |
| consul.booth.pmtools | Not in the scope | 2026-11-14 |
| docker.booth.pmtools | Not in the scope | 2026-11-14 |
| 249jira.booth.pmtools | Not in the scope | 2026-11-14 |
| nexus2019.booth.pmtools | Not in the scope | 2026-11-14 |
| yama9jira.booth.pmtools | Not in the scope | 2026-11-14 |
| kubernetes.booth.pmtools | Not in the scope | 2026-11-14 |
| next-nexus.booth.pmtools | Not in the scope | 2026-11-14 |
| yuukoku-wiki.booth.pmtools | Not in the scope | 2026-11-14 |
| harbor-town8901.booth.pmtools | Not in the scope | 2026-11-14 |
11 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.