Skip to content

Bug bounty program

UI

Ubiquiti Inc.

Platform
HackerOne
Bounties
Pays
Assets in scope
53
Disclosed reports
98
Subdomains
65,627
Vendor on CyberSIXT
Ubiquiti Inc (145 CVEs, 4 exploited), Ui (54 CVEs, 0 exploited)

Most upvoted reports98

All reports
Most upvoted reports of Ubiquiti Inc.
ReportWeaknessDisclosedBountyVotes
Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928Command and Code Injection2019-11-08–553
Privilege-0 to Root Privilege Escalation on EdgeSwitchAnalysed#511025Access Control2019-03-31–82
Public Jenkins instance with /script enabledAnalysed#403402Command and Code Injection2018-09-10–74
Remote Code Execution at http://tw.corp.ubnt.comAnalysed#269066Command and Code Injection2017-11-29–61
Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entryAnalysed#145224Access Control2016-11-27–57
CORS Misconfiguration leading to Private Information DisclosureAnalysed#430249Access Control2019-06-07–57
Login as root without password on EdgeSwitchXAnalysed#512958Authentication2019-03-31–56
Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com#172137Cross-Site Request Forgery2016-11-29–55
Ability to log in as any user without authentication if █████████ is emptyAnalysed#215053Authentication2017-08-08–54
Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.comAnalysed#301406No weakness recorded2018-03-07–47

Subdomains65,627

Subdomains of Ubiquiti Inc.
NameScopeFirst seen
382b2a67-a4f1-4953-9032-0cbd216ff48d.unifi-hosting.dev.ui.comdevIn scope2026-11-14
384becf2-487f-11ec-a110-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
386a18e0-3c94-11ec-9f0c-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
38723f25-6c0d-4fd0-8be6-48c0b68ec67a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
388b196d-7b33-41c9-a9c7-c6c60fba3967.unifi-hosting.dev.ui.comdevIn scope2026-11-14
38e57821-9839-4058-b30c-7deb53559182.unifi-hosting.dev.ui.comdevIn scope2026-11-14
38eed358-acec-4294-b2a5-8e8b68f582fe.unifi-hosting.dev.ui.comdevIn scope2026-11-14
390fb3ef-577f-4371-a57a-ea1b903cf491.unifi-hosting.dev.ui.comdevIn scope2026-11-14
393041b2-4211-4092-b4b4-b1520ace2043.unifi-hosting.dev.ui.comdevIn scope2026-11-14
39384c91-13e4-4be8-b111-f590c61eebe6.unifi-hosting.dev.ui.comdevIn scope2026-11-14
395fa6fa-2970-4ac3-b659-3bf91bba0206.unifi-hosting.dev.ui.comdevIn scope2026-11-14
397c455a-fe2a-43bb-aa0b-6375f8d68a0f.unifi-hosting.dev.ui.comdevIn scope2026-11-14
39809c36-2cdb-11ec-8876-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
399e5d5e-44ae-406d-9b5e-2362b81aa5e6.unifi-hosting.dev.ui.comdevIn scope2026-11-14
39a21232-5669-4e67-8e87-bcc1c897f478.unifi-hosting.dev.ui.comdevIn scope2026-11-14
39b4d3df-0fec-4640-ad95-3bd1ad425d1c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
39b78c59-0d97-4c80-9d8e-bf2581efc1d6.unifi-hosting.dev.ui.comdevIn scope2026-11-14
39c3d8f3-ad09-4fb3-945b-438606fd8390.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3a7f48dd-8849-4c1e-98a5-d2c7bc975d91.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3aa57431-a0b8-4dde-b16f-fc4421286340.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3ac38ed7-cae8-4649-ad46-5629675221cc.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3ade7ff3-ae0e-46fc-bb21-85440ad04638.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3ae80a77-c230-4a50-afb5-800e7ae700f0.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3af56123-0d52-410b-b3d2-5616c4102148.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3b2fbb0b-1ccd-42af-b146-7aaa83bcdc60.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3b35bc9e-42fe-4b4b-81e6-1ff782b9f2d1.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3b38ee8d-283e-461b-b4d6-517e6416ef8c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3b4c12cd-b0a9-4142-99a9-5393d48fe248.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3b974973-351d-4d71-9415-8d5a3c312641.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3ba70f8e-6f8a-448e-9d39-65bca68bc2b9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3bb3a279-b07a-45e4-a111-33878e766fc9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3bbbb8b8-9325-4395-a187-244a3efd8982.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3bf05cc0-b7c8-4e2d-b9db-3085c2ef3852.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3c18fc53-d764-4528-8f6e-ec021cfaff09.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3c417c4c-3c94-11ec-9f0c-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3c9f8352-e0d6-46f6-8dc0-32e003c0985f.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3cafc971-115a-4310-b52c-5b861a297963.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3cbca0b1-5c9c-4d04-a2c4-67f427e97d23.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3ce928ff-8915-4faa-836c-6454dcf5f4ff.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3cfecb71-78f4-4fbd-a00d-2ede14d89b0b.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3d104e87-b6d8-437f-8cd0-052a8bff14bf.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3d30d6c9-91a2-47b2-b2db-ce1cfec9a55c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3d4b4cd3-7a41-4662-ae41-713a379f60b9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3d5ea907-8a02-4f09-8782-72a0df7d446a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3d89dd69-d830-4f32-af1d-3c3c4ddaab65.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3d8bc4b2-f0c4-48ce-96ce-693946a0690c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3d965637-a3e6-4c05-9224-45b671f9a55a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3db71c19-9e72-4ff5-a1e0-ecf536fa7737.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3e028cef-3854-4669-817b-5ed59d78bc23.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3e119cbe-2cdb-11ec-8876-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3e15e092-6fb6-4121-9dd8-f5e6546f82ee.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3e20bbc6-3ef0-40e9-adcb-50e26b012f51.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3ef0126f-458f-45ff-b25d-97edf9670f23.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3efd908e-68e2-41d4-951f-3dedd7b6c192.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3f182ca5-3ce3-4571-9684-40b48274c2e0.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3f28d202-f22e-4656-9f25-7a86937543bd.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3f3c6a5d-7aa9-4957-a621-1a3064b5459a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3f4cd1c1-845f-4dfc-95ac-0f15c2325fc1.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3f73133e-553a-43e9-aa82-c494ebafddf8.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3f9fba9c-6194-4b1e-9c31-6218500f0a87.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3ffdd087-9f7c-4006-8e14-4108cbe99b44.unifi-hosting.dev.ui.comdevIn scope2026-11-14
401773d3-f03b-485a-ac8f-1d47e044f73e.unifi-hosting.dev.ui.comdevIn scope2026-11-14
401ab054-4c34-4200-8bfc-4394e8652ac7.unifi-hosting.dev.ui.comdevIn scope2026-11-14
401ed381-7d08-4b1e-b48b-4be3ec9fcb56.unifi-hosting.dev.ui.comdevIn scope2026-11-14
4034558d-a4c2-4609-bb09-b289f2de82c3.unifi-hosting.dev.ui.comdevIn scope2026-11-14
404be959-196d-4ed7-ab7d-c7513273af2b.unifi-hosting.dev.ui.comdevIn scope2026-11-14
407444f0-c87b-464a-b215-3a2ae49521b7.unifi-hosting.dev.ui.comdevIn scope2026-11-14
409b4283-6d3c-4922-bba9-5c8a6946998e.unifi-hosting.dev.ui.comdevIn scope2026-11-14
40f5981b-c538-4e1c-b150-37a53d25d822.unifi-hosting.dev.ui.comdevIn scope2026-11-14
41077ef0-308c-40d6-aafb-efbc859368c9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
414090ee-acba-47d9-a863-e69f6460552f.unifi-hosting.dev.ui.comdevIn scope2026-11-14
41426f0a-42dc-11ec-920f-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
415562f5-2917-48f0-a6da-b77c345605fe.unifi-hosting.dev.ui.comdevIn scope2026-11-14
41618f60-36d9-4394-88e8-33a197167af8.unifi-hosting.dev.ui.comdevIn scope2026-11-14
41d8625f-0b92-4ad1-b4a3-fe1f12ce9c19.unifi-hosting.dev.ui.comdevIn scope2026-11-14
4226d292-2cdb-11ec-8876-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
425e654c-3605-42a4-92fd-d2741ef2b8d2.unifi-hosting.dev.ui.comdevIn scope2026-11-14
42abce48-3759-407e-9614-c3ec915ab1d6.unifi-hosting.dev.ui.comdevIn scope2026-11-14
42b3925f-7cd5-4c3c-adc6-663fe00176c9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
430152a0-f158-4537-b7c8-5625a9d51969.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43038615-6bab-460c-8986-287052427d7f.unifi-hosting.dev.ui.comdevIn scope2026-11-14
4327c90b-d24f-4a90-87cb-d22b491f5c18.unifi-hosting.dev.ui.comdevIn scope2026-11-14
4338ba4a-9d2b-43a2-98d0-37514cf1a19f.unifi-hosting.dev.ui.comdevIn scope2026-11-14
433e529d-5032-4850-87e5-06d92f8a3635.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43b4ac81-d03b-412a-b083-389a55db423a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43bc9349-fe93-4ee4-8e43-01c67c75d35e.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43c4e696-a5eb-4cc6-b1df-4304dec1ca1a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43c68764-f88b-47ce-928a-2f69b3a8911c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43c7c7c0-9660-41da-bf67-256f741877ed.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43d64671-2666-4db9-bb5b-80a5f97975e5.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43de8261-9e96-435f-ad87-3f55635bd544.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43e1ce60-7819-4f03-ac26-d70b47609875.unifi-hosting.dev.ui.comdevIn scope2026-11-14
43eaa84f-453b-4968-818f-fb2f61602570.unifi-hosting.dev.ui.comdevIn scope2026-11-14
4452b80c-e63d-48b3-b5fa-acb6369b772f.unifi-hosting.dev.ui.comdevIn scope2026-11-14
447fa480-e9b3-46b3-923c-25a08620c37e.unifi-hosting.dev.ui.comdevIn scope2026-11-14
4493835f-e63c-48d1-8987-812d14f513ac.unifi-hosting.dev.ui.comdevIn scope2026-11-14
449a44c9-e96a-41ba-9270-b5bb3fde2c66.unifi-hosting.dev.ui.comdevIn scope2026-11-14
44bfb94b-4c54-4e31-ab76-bc762b0e161a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
44d626d5-8632-4759-825e-7d0907f17f71.unifi-hosting.dev.ui.comdevIn scope2026-11-14
44dd3321-8a5a-4549-93ca-b8795ef3631f.unifi-hosting.dev.ui.comdevIn scope2026-11-14

65,568 names are covered by the program's own scope; 140 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.