Browse / FetLife

FetLife

See its reports on the map

Attack surface: 526 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to FetLife

• Information Disclosure6
• Cross-site Scripting2
• Denial of Service1
• Business Logic1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Google API key leaked to PublicInformation Disclosure · low
   228 votes
2. Stored XSS via `Create a Fetish` section.Cross-site Scripting (XSS) - Stored · medium
   98 votes
3. Stored XSS via Angular Expression injection via Subject while starting conversation with other users.Cross-site Scripting (XSS) - Stored · medium
   82 votes
4. Able to access private picture/video/writing when requesting for their JSON responseInformation Disclosure · medium
   73 votes
5. Able to see location coordinates in any event without permission to do soInformation Disclosure · low
   62 votes
6. Specific Payload makes a Users Posts unavailableUncontrolled Resource Consumption · medium
   $10049 votes
7. Able to detect if a user is FetLife supporter although this user hides their support badge in fetlife.com/conversations/{id} JSON responseInformation Disclosure · medium
   34 votes
8. Race condition in endpoint POST fetlife.com/users/invitation, allow attacker to generate unlimited invitesBusiness Logic Errors · medium
   30 votes