Browse / EXNESS

EXNESS

See its reports on the map

Attack surface: 307 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to EXNESS

• Access Control4
• Insecure Direct Object Reference4
• Server-Side Request Forgery2
• Other weaknesses2
• Business Logic1
• Injection and Smuggling1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SSRF in graphQL query (pwapi.ex2b.com)Server-Side Request Forgery (SSRF) · medium
   $3,000261 votes
2. Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumerationServer-Side Request Forgery (SSRF) · medium
   120 votes
3. Unrestricted Access to Celery Flower InstanceImproper Access Control - Generic · high
   97 votes
4. IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit of Any MT Account Insecure Direct Object Reference (IDOR) · medium
   58 votes
5. Taking position in a discontinued forex pair without executing any tradesmedium
   32 votes
6. [com.exness.android.pa Android] Universal XSS in webview. Lead to steal user cookiesImproper Access Control - Generic · low
   $40026 votes
7. Verification process done using different documents without corresponding to user information / User information can be changed after verificationBusiness Logic Errors · medium
   25 votes
8. Access control vulnerability (read-only)Insecure Direct Object Reference (IDOR) · medium
   25 votes
9. Access control vulnerability (read/write)Insecure Direct Object Reference (IDOR) · medium
   22 votes
10. Double forward slash breaks server-side restrictions & allows access to prohibited services from a partner accountlow
    16 votes
11. CRLF Injection - Http Response Splitting CRLF Injection · low
    $20015 votes
12. Acess control vulnerability (read/write)Insecure Direct Object Reference (IDOR) · medium
    12 votes
13. Improper Implementation of SDK Allows Universal XSS in Webview Leading to Account TakeoverImproper Access Control - Generic · low
    11 votes
14. subdomain takeover at odoo-staging.exness.ioPrivilege Escalation · low
    9 votes