Browse / GitLab

GitLab

See its reports on the map

Attack surface: 785 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to GitLab

• Cross-site Scripting57
• Access Control53
• Information Disclosure32
• Code Execution18
• Server-Side Request Forgery18
• Misconfiguration16

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Login email verification bypass via `/oauth/token`.InformativeMissing Critical Step in Authentication
   66 votes
2. Removed Guest role user who dosent have access to private project in members able to view jobs InformativeImproper Authorization
   38 votes
3. Unauthorized accessInformativeImproper Access Control - Generic · medium
   18 votes
4. Container escape on public GitLab CI runnersInformativeImproper Access Control - Generic · high
   12 votes
5. Bypass for Domain-level redirects (Unvalidated Redirects and Forwar)InformativeOpen Redirect · medium
   7 votes
6. Responsible Disclosure of Privacy Leakage IssueInformativePrivacy Violation · high
   7 votes
7. Dependecy Confusion via Lookup Request Forwarding to PyPi.orgInformativeMisconfiguration
   6 votes
8. Found Origin IP's lead to access to gitlabInformativeImproper Access Control - Generic · medium
   6 votes
9. Stored-XSS in merge requestsInformativeCross-site Scripting (XSS) - Reflected
   6 votes
10. Arbitrary escape sequence injection in docker-machine from worker nodesInformativeCommand Injection - Generic · low
    5 votes
11. Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilitiesInformativeInformation Disclosure · medium
    2 votes
12. Lack of validation before assigning custom domain names leading to abuse of GitLab pages serviceInformativePhishing · medium
    2 votes
13. Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code ExecutionInformativeViolation of Secure Design Principles · low