Skip to content
Connect AISign inSign up free

Bug bounty program

PW

PortSwigger Web Security

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
10
Disclosed reports
40
Subdomains
928
Vendor on CyberSIXT
Portswigger (5 CVEs, 0 exploited)

Most upvoted reports40

All reports
Most upvoted reports of PortSwigger Web Security
ReportWeaknessDisclosedBountyVotes
Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingAnalysed#3712279File and Path Handling2026-06-14$5,000176
RCE of Burp Scanner / Crawler via ClickjackingAnalysed#1274695Command and Code Injection2023-10-10$3,000172
[portswigger.net] Path Traversal al /cms/audioitemsAnalysed#2424815File and Path Handling2024-04-04–146
DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolAnalysed#3176157Server-Side Request Forgery2025-10-08–144
Build fetches jars over HTTPAnalysed#506161Cryptography2019-06-10$1,000135
HTML Injection in Swing can disclose netNTLM hash or cause DoSAnalysed#1054382Information Disclosure2021-03-29$1,000117
CSP bypass on PortSwigger.net using Google script resourcesAnalysed#2279346Cross-site Scripting2024-02-18–113
HTML Injection in DAST Trial Request Form Confirmation Email – PortSwiggerAnalysed#3556892No weakness recorded2026-02-26$20093
Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumptionAnalysed#3625600No weakness recorded2026-05-05$20092
Burp Suite extensions can execute arbitrary code#3014158No weakness recorded2025-02-26–85

Subdomains928

Root
Scope
Name suggests:Development
First seen
Text fileClear filters0 names

No subdomain matches

Remove a filter or pick another root.

Clear filters

5 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated