Browse / Algolia

Algolia

See its reports on the map

Attack surface: 25,217 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Algolia

• Cross-site Scripting12
• Information Disclosure6
• Authentication6
• Misconfiguration5
• Code Execution1
• Path Traversal1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Information disclosure via a misconfigured third-party productInformation Disclosure · high
   156 votes
2. Information disclosure -> 2fa bypass -> POST exploitation Information Disclosure · medium
   76 votes
3. RCE on facebooksearch.algolia.comCode Injection
   $50074 votes
4. email verification bypassImproper Authentication - Generic · medium
   67 votes
5. Web Cache Deception vulnerability on algolia.com leads to personal information leakageViolation of Secure Design Principles · medium
   $40047 votes
6. Stored xss Cross-site Scripting (XSS) - Generic
   $10041 votes
7. Directory traversal at https://msg.algolia.comPath Traversal · medium
   34 votes
8. subdomain take over at recommendation.algolia.comViolation of Secure Design Principles · medium
   27 votes
9. Web Cache Deception Attack (XSS)Cross-site Scripting (XSS) - Reflected · medium
   26 votes
10. [GitHub Extension] Unsanitised HTML leading to XSS on GitHub.comCross-site Scripting (XSS) - DOM · high
    26 votes
11. Hyperlink Injection in Friend Invitation EmailsOpen Redirect
    $10020 votes
12. 2-factor authentication bypassImproper Authentication - Generic
    20 votes
13. Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed.Improper Authentication - Generic
    $40019 votes
14. [github.algolia.com] DOM Based XSS github-btn.htmlCross-site Scripting (XSS) - Generic · medium
    $10015 votes
15. No rate limit for Referral ProgramViolation of Secure Design Principles
    15 votes
16. Reflected XSSCross-site Scripting (XSS) - Generic
    14 votes
17. PHP-FPM status page disclosureInformation Disclosure · low
    12 votes
18. Stored xssCross-site Scripting (XSS) - Generic
    12 votes
19. An “algobot”-s GitHub access token was leakedInformation Disclosure · medium
    $10010 votes
20. Possilbe Sub Domain takever at prestashop.algolia.com
    9 votes
21. Stored XSS triggered by json key during UI generationCross-site Scripting (XSS) - Generic
    7 votes
22. No Rate Limit In Inviting Similar Contact Multiple TimesCryptographic Issues - Generic
    $1006 votes
23. No rate-limit in Two factor Authentication leads to bypass using bruteforce attackImproper Authentication - Generic
    $1006 votes
24. API Key added for one Indices works for all other indices too.Improper Authentication - Generic
    $1,0006 votes
25. Stored XSS in name selectionCross-site Scripting (XSS) - Generic
    $1006 votes
26. Text injection on status.algolia.comViolation of Secure Design Principles · low
    4 votes
27. Stored XSS from Display Settings triggered on Save and viewing realtime search demoCross-site Scripting (XSS) - Generic
    4 votes
28. [github.algolia.com] XSSCross-site Scripting (XSS) - Generic
    4 votes
29. SAUCE Access_key and User_name leaked in Travis CI build logsInformation Disclosure · medium
    3 votes
30. User with limited access to Index configuration can rename the IndexImproper Authentication - Generic
    $2003 votes
31. PHP version disclosed on blog.algolia.comInformation Disclosure
    2 votes
32. text injection can be used in phishing 404 page should not include attacker textViolation of Secure Design Principles
    $1002 votes
33. an xss issueCross-site Scripting (XSS) - Generic
    $1002 votes
34. Stored XSS on https://www.algolia.com/realtime-search-demo/*Cross-site Scripting (XSS) - Generic
    2 votes