Bug bounty program
TE
Top Echelon Software
Most upvoted reports6
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Clickjacking in main domain https://topechelon.com/#2964441 | No weakness recorded | 2025-02-10 | – | 80 |
| Public and secret api key leaked in JavaScript source#1051029 | Access Control | 2021-01-19 | – | 21 |
| xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)#1622867 | Denial of Service | 2022-08-08 | – | 14 |
| able to login into login.topechelon.com#712318 | Access Control | 2020-05-20 | – | 12 |
| Disable xmlrpc.php file#712321 | No weakness recorded | 2022-08-11 | – | 10 |
| Wordpress Users Disclosure (/wp-json/wp/v2/users/)#1663363 | Information Disclosure | 2022-08-11 | – | 6 |
Subdomains113
3 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.