Browse / IRCCloud

IRCCloud

See its reports on the map

Attack surface: 581 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to IRCCloud

• Cross-Site Request Forgery12
• Misconfiguration11
• Cross-site Scripting7
• Authentication5
• Insecure Direct Object Reference1
• Information Disclosure1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. IDOR with Geolocation data not stripped from imagesInsecure Direct Object Reference (IDOR) · high
   $20066 votes
2. XSS from Mastodon embedsCross-site Scripting (XSS) - Generic · high
   $50063 votes
3. Cross Site Scripting(XSS) on IRCCloud Badges Page (using Parameter Pollution)Cross-site Scripting (XSS) - Generic
   48 votes
4. [IRCCloud Android] XSS in ImageViewerActivityCross-site Scripting (XSS) - Generic · medium
   44 votes
5. [IRCCloud Android] Theft of arbitrary files leading to token leakagePrivacy Violation · high
   31 votes
6. Full account takeover using CSRF and password resetCross-Site Request Forgery (CSRF)
   17 votes
7. [IRCCloud Android] Opening arbitrary URLs/XSS in SAMLAuthActivityCross-site Scripting (XSS) - Generic · medium
   16 votes
8. Exposed, outdated nginx server (v1.4.6) potentially vulnerable to heap-based buffer overflow & RCEMemory Corruption - Generic
   15 votes
9. Host Header Injection - irccloud.comViolation of Secure Design Principles
   $10010 votes
10. Login CSRF can be bypassed (Similar approach to previous one).Cross-Site Request Forgery (CSRF)
    8 votes
11. Bug in iOS application which could lead to unauthorised access.Improper Authentication - Generic
    6 votes
12. Missing X-Content-Type-OptionsViolation of Secure Design Principles
    6 votes
13. Missing robots exclusion header for user uploadsImproper Access Control - Generic · low
    $505 votes
14. DNS MisconfigurationMisconfiguration
    5 votes
15. iOS application does not destroy session upon logout.Improper Authentication - Generic
    5 votes
16. Session Token is not Verified while changing Account Setting's which Result In account TakeoverCross-Site Request Forgery (CSRF)
    5 votes
17. Leaking Referrer in Reset Password LinkViolation of Secure Design Principles
    $1005 votes
18. Dangerous Persistent xssCross-site Scripting (XSS) - Generic
    4 votes
19. Host Header is not validated resulting in Open RedirectViolation of Secure Design Principles
    $1004 votes
20. CSRF to Account Take Over Bug Cross-Site Request Forgery (CSRF)
    4 votes
21. Sign up CSRFCross-Site Request Forgery (CSRF)
    $1004 votes
22. Inadequate input validation on API endpoint leading to self denial of service and increased system load.Uncontrolled Resource Consumption
    $5003 votes
23. Reflected XSS in Pastebin-viewCross-site Scripting (XSS) - Generic
    3 votes
24. Persistent Cross Site Scripting within the IRCCloud Pastebin Cross-site Scripting (XSS) - Generic
    $5003 votes
25. User Account Creation CSRF Cross-Site Request Forgery (CSRF)
    3 votes
26. HTML Form without CSRF protectionCross-Site Request Forgery (CSRF)
    3 votes
27. Bruteforcing irccloud loginViolation of Secure Design Principles
    $1003 votes
28. Unsecure cookies, cookie flag secure not setViolation of Secure Design Principles
    $1003 votes
29. Login CSRFCross-Site Request Forgery (CSRF)
    $1002 votes
30. Unvalidated Channel names causes IRC Command InjectionCross-Site Request Forgery (CSRF)
    $3001 votes
31. Log Out Cross site Request ForgeryCross-Site Request Forgery (CSRF)
    1 votes
32. CSRF - Creating accountsCross-Site Request Forgery (CSRF)
    1 votes
33. Session cookie can be leaked over an unencrypted HTTP connectionViolation of Secure Design Principles
    1 votes