Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Bypass extension check leads to stored XSS at https://s2.booth.pmAnalysed#1019425 | Valid | Cross-site Scripting | Medium | 2021-01-08 | – | 30 |
| CSRF at https://chatstory.pixiv.net/importedAnalysed#534908 | Valid | Cross-Site Request Forgery | Medium | 2020-07-02 | $500 | 31 |
| Open redirect protection (https://www.pixiv.net/jump.php) is broken for novelsAnalysed#541862 | Valid | Open Redirect | Low | 2019-10-01 | $200 | 42 |
| RCE due to ImageTragick v2Analysed#402362 | Valid | Command and Code Injection | Critical | 2021-03-16 | $2,000 | 44 |
| Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.netAnalysed#3100570 | Valid | Access Control | Low | 2026-04-27 | – | 53 |
| Non-premium user can disable Ads in japanese version of dic.pixiv.netAnalysed#3183520 | Valid | Input Validation and Logic | High | 2026-04-27 | $3,000 | 123 |
| Disclose Hidden Comments on Media Section of hub.vroid.comAnalysed#2541962 | Valid | Insecure Direct Object Reference | Medium | 2026-01-18 | $500 | 149 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.