Bug bounty program
QU
Quora
Most upvoted reports8
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| XSS through `__e2e_action_id` delivered by JSONPAnalysed#259100 | Cross-site Scripting | 2018-03-08 | – | 53 |
| [Android] XSS via start ContentActivityAnalysed#189793 | Cross-site Scripting | 2017-04-05 | – | 50 |
| [Quora Android] Possible to steal arbitrary files from mobile deviceAnalysed#258460 | Information Disclosure | 2017-08-30 | – | 23 |
| XSS when clicking "Share to Twitter" at quora.com/widgets/embed_iframe?path=...Analysed#258876 | Cross-site Scripting | 2018-01-11 | – | 21 |
| [controlsyou.quora.com] 429 Too Many Requests Error-Page XSSAnalysed#189768 | Cross-site Scripting | 2017-03-31 | – | 20 |
| self xss in#228539 | Cross-site Scripting | 2017-05-22 | – | 7 |
| IDNs displayed in unicode#266454 | Misconfiguration and Insecure Design | 2017-10-25 | – | 6 |
| Possibility of DOS Through logging System#242489 | No weakness recorded | 2017-08-16 | – | 2 |
Subdomains51,611
| Name | Scope | First seen |
|---|---|---|
| api.quora.comapi | In scope | 2026-11-14 |
| cdq-api.quora.comapi | In scope | 2026-11-14 |
| cim-api.quora.comapi | In scope | 2026-11-14 |
| cim-api-dev.quora.comapi, dev | In scope | 2026-11-14 |
| cim-api-qa.quora.comapi, test | In scope | 2026-11-14 |
| cim-api-uat.quora.comapi, test | In scope | 2026-11-14 |
| gws-api-sandbox.quora.comapi, test | In scope | 2026-11-14 |
| ks-inventory-api.quora.comapi | In scope | 2026-11-14 |
| ks-invoice-api.quora.comapi | In scope | 2026-11-14 |
| ks-limits-api.quora.comapi | In scope | 2026-11-14 |
| ks-order-api.quora.comapi | In scope | 2026-11-14 |
| ks-program-api.quora.comapi | In scope | 2026-11-14 |
| pantera-api.quora.comapi | In scope | 2026-11-14 |
| vendor-api.quora.comapi | In scope | 2026-11-14 |
51,595 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.