Skip to content

Bug bounty program

UI

Ubiquiti Inc.

Platform
HackerOne
Bounties
Pays
Assets in scope
53
Disclosed reports
98
Subdomains
65,627
Vendor on CyberSIXT
Ubiquiti Inc (145 CVEs, 4 exploited), Ui (54 CVEs, 0 exploited)

Most upvoted reports98

All reports
Most upvoted reports of Ubiquiti Inc.
ReportWeaknessDisclosedBountyVotes
Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928Command and Code Injection2019-11-08–553
Privilege-0 to Root Privilege Escalation on EdgeSwitchAnalysed#511025Access Control2019-03-31–82
Public Jenkins instance with /script enabledAnalysed#403402Command and Code Injection2018-09-10–74
Remote Code Execution at http://tw.corp.ubnt.comAnalysed#269066Command and Code Injection2017-11-29–61
Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entryAnalysed#145224Access Control2016-11-27–57
CORS Misconfiguration leading to Private Information DisclosureAnalysed#430249Access Control2019-06-07–57
Login as root without password on EdgeSwitchXAnalysed#512958Authentication2019-03-31–56
Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com#172137Cross-Site Request Forgery2016-11-29–55
Ability to log in as any user without authentication if █████████ is emptyAnalysed#215053Authentication2017-08-08–54
Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.comAnalysed#301406No weakness recorded2018-03-07–47

Subdomains65,627

Subdomains of Ubiquiti Inc.
NameScopeFirst seen
264a02c5-9de7-4046-8079-1b7e30602d05.unifi-hosting.dev.ui.comdevIn scope2026-11-14
265a098d-8f9b-48a9-9c52-8b6fed178447.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2673f4d8-4799-4fd1-a117-8e765e9afdb3.unifi-hosting.dev.ui.comdevIn scope2026-11-14
267c8b45-76e9-43ce-add4-f17748d3ff03.unifi-hosting.dev.ui.comdevIn scope2026-11-14
26aa7b70-fa71-43be-beac-aaf6372ca1ce.unifi-hosting.dev.ui.comdevIn scope2026-11-14
26cc21af-6faf-4b1c-a654-22d8fd92f2c7.unifi-hosting.dev.ui.comdevIn scope2026-11-14
26e19e41-6424-4e08-8c1b-bceecc257276.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2724a54e-47d1-11ec-a110-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
272f5982-83bc-40fb-8056-1dc0685addbd.unifi-hosting.dev.ui.comdevIn scope2026-11-14
273de7bb-71eb-4719-a1a5-49ac384628e7.unifi-hosting.dev.ui.comdevIn scope2026-11-14
27702a97-a0bb-4ccb-bcfd-ff99e96b0bba.unifi-hosting.dev.ui.comdevIn scope2026-11-14
277098da-4882-11ec-a110-0a58a9feac02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2780f31c-571e-4160-8960-6287f2e6bdee.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2789640f-27a7-4b15-9deb-5454196b8519.unifi-hosting.dev.ui.comdevIn scope2026-11-14
27ab1d62-6aee-44cd-a582-cbc741e1f8e7.unifi-hosting.dev.ui.comdevIn scope2026-11-14
27b5b3ff-a87b-44cf-95ed-0a600503722b.unifi-hosting.dev.ui.comdevIn scope2026-11-14
27ce5067-8ca5-4369-80a1-bf549a6741b3.unifi-hosting.dev.ui.comdevIn scope2026-11-14
27e3b285-e561-4e17-ac38-ffcf03339d02.unifi-hosting.dev.ui.comdevIn scope2026-11-14
280afb1b-1a0b-409d-91bb-3b1e3eeaf4e5.unifi-hosting.dev.ui.comdevIn scope2026-11-14
281a2189-1e35-4f88-8f70-0e2cae1bf78c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
281fabe2-13dc-4faf-9625-d6585d85510c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
284c79f4-d051-422a-a008-b82d941dbcc6.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2858d549-9b72-45ec-a4e5-1311e484fc92.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2862362f-7a55-4a60-9271-76944680e2fc.unifi-hosting.dev.ui.comdevIn scope2026-11-14
28730dec-28f0-46ba-a4db-1e1f4b1bdbb5.unifi-hosting.dev.ui.comdevIn scope2026-11-14
288e24c5-cd8d-41ce-be0d-687f72a260ad.unifi-hosting.dev.ui.comdevIn scope2026-11-14
28c7a53f-cd64-4152-93dc-b751c98f4657.unifi-hosting.dev.ui.comdevIn scope2026-11-14
291da5f7-e00c-438a-897d-aca37d384975.unifi-hosting.dev.ui.comdevIn scope2026-11-14
29681ef2-1a30-4936-b35f-4610054c20fa.unifi-hosting.dev.ui.comdevIn scope2026-11-14
29d0a25e-b1fe-4b58-a7bc-a16fe19806f6.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2a04a48e-f38d-4510-bda2-bb9d507c79f7.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2a0adb17-030b-4b2f-8af4-9b935b4c01ab.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2a3b5587-38ee-4100-b1b0-6ec00d94edba.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2a605777-1e48-4e8a-93d6-2be7d1a9a05d.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2a8cb158-5b20-4a29-b6b4-9d05d4788e8c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2aa357a1-7da3-41e5-906c-6b36837aee16.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2aa66f12-6f14-4586-811a-c9e116e4732a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2acc906d-105f-4907-9fda-99e8dbf3dff5.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2aeeca6c-0560-452c-b365-acd4e8f17f3b.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2aff9ee6-8cf4-4c8b-95d0-18677efc4ab9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2affa128-2a87-4323-898f-eb4a6fa46d62.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2b1cb12a-caeb-4cbf-a20d-f1d908d978a9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2b3554b4-0bc6-47d3-8452-f07bf60b27fc.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2b3a52db-d157-44b8-b464-1416080c3735.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2b4f10da-ca78-482c-9e7d-22a013c3f97c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2b62e3cf-0a71-489d-9e8a-0148c6e06f32.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2b7c7134-9846-4550-9bd8-2c943f471008.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2b9500c9-3e15-4951-bb53-885299438f3c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2bb99981-61a6-44b9-a09a-e4c365b91448.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2c68600b-46fa-45af-8166-ca6f7f5b0a0e.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2ca45824-4909-45ba-a129-ce63ded3cea8.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2cbeb1a8-44de-42fb-b4b8-66741711c759.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2cc276b1-cd9a-4f4d-b7ac-ea62c14dacb6.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2cda433e-4205-498d-9870-1cfa916e6fc5.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2cdb19e4-f7b3-4700-b53a-629949ccf238.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d18d769-7393-4133-8952-796a8dfc73ef.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d2f40f1-8722-4ceb-af00-9949aa0e623d.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d3447a9-068b-49fe-8c47-454443f177ff.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d40a332-a2ab-4c3d-96ec-d7270016543d.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d42b111-f7cf-4ea3-a104-ed8670cfc8e9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d6aa430-6c0f-495d-a1b5-755ba598e2f4.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d880b11-0394-487a-877e-e21e93d7c473.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d8ee703-5433-4ed9-bcf6-447f6e073563.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d8fb96c-a9be-47c4-8ac1-8b3f763e07d3.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2d953382-2f9e-4b60-9a3c-12ff3e17698a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2dac8b94-3326-4413-9854-be3b1754b2ab.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2dc4efe2-60df-4836-8995-80e3d9b1713c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2e1a219e-cc13-4769-ba94-af444d5f7de2.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2e413d94-3493-4f45-982b-94b874d427fd.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2e8d18cb-727d-467d-8e44-3ca4c7e15cc2.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2eb8c314-ddd2-4251-9379-ff3bba81fea9.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2ed401a4-c6df-4462-80c4-4acaf60db744.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2ee31bfb-b92f-4de3-9d30-935bc6201d1d.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2f2c3585-7635-4c14-ab89-2f8b5aaf507a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2f38fbee-432c-446c-8a7d-e5f34c1d415e.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2f401eb6-7ac7-4097-b1c7-6d224f9346dd.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2f42833b-607b-4d96-a26f-1aa75144c91a.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2f520cbb-8f55-4796-a46c-ea073a7365c3.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2f5704c4-44b7-4746-ac85-d3cde9c60c98.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2faab9d8-d72c-4bdc-9e7b-ffc20bb9b415.unifi-hosting.dev.ui.comdevIn scope2026-11-14
2fd26919-66f5-40f0-830d-1638b2109cce.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3027be32-8862-4972-96de-0e639ddf6ba2.unifi-hosting.dev.ui.comdevIn scope2026-11-14
304a36e0-8ade-4858-9714-a3f8f89f327c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
305e0916-67fa-4807-b587-026c22b52802.unifi-hosting.dev.ui.comdevIn scope2026-11-14
307cecc6-c75f-45c3-8b8c-7baedde527b8.unifi-hosting.dev.ui.comdevIn scope2026-11-14
308114b0-c1c5-43f3-a6a6-8323f88ef08d.unifi-hosting.dev.ui.comdevIn scope2026-11-14
308f47f0-94d7-4765-b24d-97868b741b4d.unifi-hosting.dev.ui.comdevIn scope2026-11-14
30948bc8-ff05-4b2f-8e31-e7fa5a8730f2.unifi-hosting.dev.ui.comdevIn scope2026-11-14
30ba43c5-def8-405b-a878-eeffda8b4445.unifi-hosting.dev.ui.comdevIn scope2026-11-14
30c0bd7e-1267-4b48-aafa-9086de838472.unifi-hosting.dev.ui.comdevIn scope2026-11-14
30c2ed6f-3e66-483d-a4cb-f065e256a4e3.unifi-hosting.dev.ui.comdevIn scope2026-11-14
30dc4997-f67d-4580-ad7d-e258da1ae6e7.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3110c32f-3199-42fa-b9b8-911e3c04917c.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3155d85d-ba90-44c5-a266-773325c526ab.unifi-hosting.dev.ui.comdevIn scope2026-11-14
315b80f0-be96-4cd5-9980-85c72894c3c5.unifi-hosting.dev.ui.comdevIn scope2026-11-14
316a9251-30c4-488c-8e7d-dbcaa736f673.unifi-hosting.dev.ui.comdevIn scope2026-11-14
31736460-07c2-4762-8c0c-59ce22d79248.unifi-hosting.dev.ui.comdevIn scope2026-11-14
317814de-7ed8-43f2-a3bd-5de9549878fd.unifi-hosting.dev.ui.comdevIn scope2026-11-14
31829863-586a-4e54-8f08-668ca0096e36.unifi-hosting.dev.ui.comdevIn scope2026-11-14
3185d901-03bb-4d15-a790-53bac343129e.unifi-hosting.dev.ui.comdevIn scope2026-11-14

65,568 names are covered by the program's own scope; 140 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.