Browse / Flickr

Flickr

See its reports on the map

Attack surface: 255 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Flickr

• Open Redirect4
• Business Logic2
• Authentication1
• Code Execution1
• Cross-Site Request Forgery1
• Denial of Service1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Flickr Account Takeover using AWS Cognito APIImproper Authentication - Generic · critical
   440 votes
2. Arbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/uploadCode Injection · critical
   340 votes
3. critical server misconfiguration lead to access to any user sensitive data which include user email and passwordBusiness Logic Errors · medium
   $500116 votes
4. CSRF in Account Deletion feature (https://www.flickr.com/account/delete)Cross-Site Request Forgery (CSRF) · high
   92 votes
5. High resource consumption by insufficient sanitization of forum threads paginationAllocation of Resources Without Limits or Throttling · medium
   $47975 votes
6. Incorrect Deep-link validation leading to unresponsive application and deviceImproper Input Validation · medium
   64 votes
7. IDOR may allow access to non-public photosInsecure Direct Object Reference (IDOR) · medium
   61 votes
8. Stored XSS in photos_user_map.gneCross-site Scripting (XSS) - Stored · high
   $3,26354 votes
9. Critical broken cookie signing on dagobah.flickr.com Business Logic Errors · medium
   $47930 votes
10. Open redirect bypassOpen Redirect · low
    $30028 votes
11. Open RedirectOpen Redirect · low
    $25815 votes
12. Improper access control in place for "member only" groups via root.YUI_config.flickr.api.site_keyImproper Access Control - Generic · medium
    15 votes
13. Open redirect GET-Based on https://www.flickr.com/browser/upgrade/?continue=Open Redirect · low
    $15013 votes
14. Stored open redirect in about pageOpen Redirect · medium
    13 votes