Browse / IRCCloud

IRCCloud

See its reports on the map

Attack surface: 581 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to IRCCloud

• Cross-Site Request Forgery12
• Misconfiguration11
• Cross-site Scripting7
• Authentication5
• Insecure Direct Object Reference1
• Information Disclosure1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Login page password-guessing attack(Brute-force attack-High).InformativeImproper Authentication - Generic
   8 votes
2. Bruteforce protection not enabled on the login page https://www.irccloud.com/InformativeCryptographic Issues - Generic
   5 votes
3. "SESSION" Cookie without HttpOnly flag setInformativeImproper Authentication - Generic
   5 votes
4. Email verification links still valid after changing it 2xInformativeViolation of Secure Design Principles
   4 votes
5. Weak password policyInformativeImproper Authentication - Generic
   4 votes
6. Unwanted Spamming Using CSRF [LOGGED IN USER]InformativeCross-Site Request Forgery (CSRF)
   4 votes
7. Password type input with auto-complete enabledInformativeViolation of Secure Design Principles
   3 votes
8. Missing Character RestrictionInformativeViolation of Secure Design Principles
   2 votes