The return of the ＜ Analysed #639684 Valid Cross-site Scripting – 2019-09-24 $1,000 576 Account Takeover using Linked Accounts due to lack of CSRF protection Analysed #463330 Valid Cross-Site Request Forgery – 2019-02-20 – 238 Stealing Facebook OAuth Code Through Screenshot viewer Analysed #488269 Valid Information Disclosure – 2019-03-05 – 200 XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker) Analysed #220852 Valid Cross-site Scripting – 2021-06-03 – 194 xss on https://www.rockstargames.com/GTAOnline/jp/screens/ #507494 Valid Cross-site Scripting – 2020-06-12 – 159 Access to the business emails of Rockstar Support agents through the support platform #1920908 Valid Access Control Low 2025-10-02 $550 151 Unserialize leading to arbitrary PHP function invoke #210741 Valid Command and Code Injection – 2017-12-13 – 119 Stored XSS in Snapmatic + R★Editor comments #309531 Valid Cross-site Scripting – 2018-04-19 – 118 SocialClub Account Take Over Through Import Friends feature #901728 Valid Cross-Site Request Forgery – 2021-04-01 – 116 Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft. #787160 Valid Cross-Site Request Forgery – 2020-06-24 – 112 CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/ #474833 Valid Cross-Site Request Forgery – 2020-06-12 – 104 Password and mail address stored unencrypted in memory - Rockstar Game Launcher #1128357 Valid Cryptography – 2023-10-27 $750 91 Open redirect vulnerability #380760 Valid Open Redirect – 2019-04-03 $250 83 Blind SSRF in emblem editor (2) #265050 Valid Server-Side Request Forgery – 2017-10-28 $1,500 83 LFI and SSRF via XXE in emblem editor #347139 Valid Injection and Smuggling – 2018-08-01 $1,500 79 Cache Poisoning DoS on updates.rockstargames.com #1219038 Valid Misconfiguration and Insecure Design – 2021-12-22 – 77 XSS on rockstargames.com #212700 Valid Cross-site Scripting – 2023-07-25 $500 75 Facebook OAuth Code Theft through referer leakage on support.rockstargames.com #482743 Valid Cross-Site Request Forgery – 2019-02-19 – 71 Insecure Direct Object Reference allows Crew Invite deletion #1947924 Valid Insecure Direct Object Reference – 2023-08-17 – 67 Ticket Trick Attack allows access to ████████' workspaces #1534465 Valid Access Control High 2026-09-01 – 66 Unquoted Service Path in "Rockstar Game Library Service" #716448 Valid Access Control – 2019-12-02 – 60 Brute Force against VMware Horizon #1278072 Valid Authentication – 2021-08-16 $250 53 Social Club Account Takeover Via RGL And Steam/Epic Linked Account #1235008 Valid Access Control – 2021-11-17 – 53 SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCE #288353 Valid Server-Side Request Forgery – 2018-01-12 $1,500 52 Improper Authentication inside the Rockstar Games Launcher which leads to Account takeover to some extend #1442783 Valid Authentication – 2023-07-05 $750 51 Bypass CAPTCHA protection #210417 Valid Authentication – 2018-04-23 – 51 Open Redirection effects autodiscover.rockstargames.com #1269332 Valid No weakness recorded Low 2025-02-03 – 49 Stored XSS on support.rockstargames.com #265384 Valid Cross-site Scripting – 2017-10-10 $1,000 49 full path disclosure on www.rockstargames.com via apache filename brute forcing #210238 Valid Information Disclosure – 2019-10-04 – 48 DOM XSS on https://www.rockstargames.com/GTAOnline/feedback #803934 Valid Cross-site Scripting – 2020-06-11 – 46 DOM based XSS on /GTAOnline/tw/starterpack/ #508517 Valid Cross-site Scripting – 2020-06-24 – 46 Stored XSS in profile activity feed messages #231444 Valid Cross-site Scripting – 2017-08-28 $1,000 45 Exposed CDN access token allows modification of all newly uploaded Snapmatic photos #2184872 Valid Access Control – 2024-01-26 – 41 CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php' #152013 Valid Cross-Site Request Forgery – 2017-03-10 – 40 Smuggle SocialClub's Facebook OAuth Code via Referer Leakage #342709 Valid Information Disclosure – 2018-10-23 $750 39 <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information -> #204292 Valid Cross-Site Request Forgery – 2017-05-24 – 39 Image Injection vulnerability on screenshot-viewer/responsive/image may allow Facebook OAuth token theft. #655288 Valid Information Disclosure – 2020-06-24 – 36 Exploiting Misconfigured CORS to Steal User Information #317391 Valid Information Disclosure – 2018-10-17 $500 36 Stored XSS on profile page via Steam display name #282604 Valid Cross-site Scripting – 2017-11-10 $1,250 35 DOM Based xss on https://www.rockstargames.com/ ( 1 ) #475442 Valid Cross-site Scripting – 2020-06-12 – 34 stored XSS (angular injection) in support.rockstargames.com using zendesk register form via name parameter #354262 Valid Cross-site Scripting – 2018-11-06 $1,000 31 Stored XSS in snapmatic comments #231389 Valid Cross-site Scripting – 2017-09-05 $1,000 30 Image Injection/XSS vulnerability affecting https://www.rockstargames.com/newswire/article #790465 Valid Cross-Site Request Forgery – 2020-06-24 – 29 CSRF Vulnerability on post creation page /community/create-post.json #487378 Valid Cross-Site Request Forgery – 2020-07-07 – 29 Uninstalling Rockstar Games Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication #1278261 Valid Information Disclosure – 2022-04-07 $250 28 CSRF Vulnerability allows attackers to steal SocialClub private token. #253128 Valid Cross-Site Request Forgery – 2017-08-03 – 28 XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.js #242905 Valid Cross-site Scripting – 2017-07-17 – 28 DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax request #172843 Valid Cross-site Scripting – 2017-03-17 – 27 Reflected XSS in /Videos/ via calling a callback http://www.rockstargames.com/videos/#/?lb= #151276 Valid Cross-site Scripting – 2017-09-25 – 27 Reflected XSS via #tags= while using a callback in newswire http://www.rockstargames.com/newswire #153618 Valid Cross-site Scripting – 2017-03-16 – 26