Browse / GitHub

GitHub

See its reports on the map

Attack surface: 56,442 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to GitHub

• Access Control16
• Code Execution8
• Insecure Direct Object Reference6
• Injection and Smuggling4
• Information Disclosure3
• Misconfiguration3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Arbitrary Read of Another Users private repository without AuthorizationInsecure Direct Object Reference (IDOR) · high
   $10,000276 votes
2. Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiImproper Access Control - Generic · high
   198 votes
3. SAML Signature verification bypass allows logging into any user (with specific conditions)Improper Access Control - Generic · critical
   196 votes
4. Authentication bypass on gist.github.com through SSH CertificatesImproper Access Control - Generic · high
   $10,000182 votes
5. CSRF protection bypass in GitHub Enterprise management consoleCross-Site Request Forgery (CSRF) · high
   $10,000152 votes
6. Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationInsecure Direct Object Reference (IDOR) · medium
   108 votes
7. Able to bypass authorization logic and gain more access then intendedImproper Access Control - Generic · medium
   105 votes
8. Access body and title of Internal Repo Issues in ProjectsInformation Disclosure · medium
   100 votes
9. Github app Privilege Escalation to Administrator/Owner of the Organization Improper Access Control - Generic · high
   98 votes
10. Missing Access Control in MigrationFile allows attacker to upload files to any MigrationInsecure Direct Object Reference (IDOR) · high
    92 votes
11. GitHub Apps can access suspended installations via scoped user-to-server tokensImproper Access Control - Generic · medium
    90 votes
12. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-checkCommand Injection - Generic · high
    88 votes
13. Invite tokens have Insufficient entropy in GHES Management Console Use of Insufficiently Random Values · medium
    81 votes
14. GitHub scoped user to server tokens can escape their installationImproper Access Control - Generic · high
    80 votes
15. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forwardCommand Injection - Generic · high
    80 votes
16. OAuth redirect uri validation bypass for :proxima_first_party_sync appsOpen Redirect · high
    79 votes
17. Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/new Cross-site Scripting (XSS) - Generic · medium
    76 votes
18. Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)Information Disclosure · medium
    $4,00072 votes
19. Add labels to arbitrary issues/prs & compromise github actions label checksInsecure Direct Object Reference (IDOR) · medium
    71 votes
20. Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise ServerPrivilege Escalation · high
    71 votes
21. View private repository NWO of deploy key via internal LFS APIImproper Access Control - Generic · medium
    70 votes
22. View Repo and Title of Any Private Check RunInsecure Direct Object Reference (IDOR) · medium
    64 votes
23. Source Code and data exfiltration via Github CopilotCode Injection · low
    63 votes
24. GitHub user to server tokens can create issues in any public repositoryImproper Access Control - Generic · medium
    62 votes
25. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injectionCommand Injection - Generic · high
    61 votes
26. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ngCommand Injection - Generic · high
    61 votes
27. PATs without the required scope can leak issuesImproper Access Control - Generic · medium
    59 votes
28. Bypassing Collaborator Restrictions: Retaining Admin Access Post-Repository TransferImproper Access Control - Generic · medium
    57 votes
29. GHES Management console EoP (editor to site admin)Improper Access Control - Generic · high
    56 votes
30. Managing Pages Improper Access Control - Generic · medium
    54 votes
31. DoS via markdown API from unauthenticated userUncontrolled Resource Consumption · medium
    $4,00054 votes
32. Persistent Unauthorized Administrative Access on All Organization Repositories via RC in User Conversion to OrganizationImproper Authentication - Generic · medium
    51 votes
33. RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionMisconfiguration · medium
    50 votes
34. RC Between GitHub's Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access RetentionMisconfiguration · medium
    50 votes
35. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectdCommand Injection - Generic · high
    47 votes
36. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-consoleCommand Injection - Generic · high
    47 votes
37. Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating Insecure Direct Object Reference (IDOR) · medium
    46 votes
38. Rogue collaborators and ambiguous branch names in GitHubBusiness Logic Errors
    43 votes
39. [PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissionsImproper Access Control - Generic · medium
    42 votes
40. Delimiter injection in GitHub Actions core.exportVariableMisconfiguration · medium
    $4,61739 votes
41. Smuggling content in PR with refs/replace in GitHubResource Injection · medium
    35 votes
42. Sample report: Denial of service LLM06: Sensitive Information Disclosure
    33 votes
43. Command injection in GitHub Actions ContainerStepHostResource Injection
    $4,00032 votes
44. [PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permissionImproper Access Control - Generic · medium
    31 votes
45. Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code ExecutionResource Injection · medium
    25 votes
46. Improper handling of null bytes in GitHub Actions Runner allows an attacker to set arbitrary environment variablesResource Injection · medium
    19 votes
47. [Git Gud] GitHub.com Svnbridge memcached deserialization vulnerability chain leading to Remote Code ExecutionDeserialization of Untrusted Data · medium
    14 votes