Skip to content
Sign in

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:PayPal
Status
Severity
Weakness
Year
Bounty paid7
Access stated
  • No account0
  • A user account0
  • Admin or privileged0
Access needed
Technique
Clear filters13 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/#799881ValidCross-site Scripting–2021-02-10–54
XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victim#450796ValidCross-Site Request Forgery–2019-02-07$3,50081
Unsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]#453791ValidDeserialization and Object Injection–2021-04-30–93
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)#425200ValidCross-site Scripting–2018-11-06–100
Reflected XSS at https://www.paypal.com/ppcreditapply/da/us#753835ValidCross-site Scripting–2020-05-19–137
[Venmo Android] Remote theft of user session#401940ValidOpen Redirect–2019-02-07–151
[PayPal Android] Remote theft of user session using push_notification_webview deeplink#424443ValidOpen Redirect–2019-02-07–188
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147ValidInjection and Smuggling–2019-08-07$18,900685
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081ValidInsecure Direct Object Reference–2019-07-30$10,500797
DoS on PayPal via web cache poisoningAnalysed#622122ValidDenial of Service–2019-10-23$9,700851
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585ValidCommand and Code Injection–2021-02-09$30,000946
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737ValidAuthentication–2020-01-08$15,3001,409
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152ValidInjection and Smuggling–2019-08-07$20,0002,687

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in