Browse / Imgur

Imgur

See its reports on the map

Attack surface: 43,093 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Imgur

• Cross-site Scripting18
• Code Execution4
• Authentication4
• Cryptography4
• Information Disclosure3
• Misconfiguration3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Stored XSS on imgur profileCross-site Scripting (XSS) - Stored · medium
   614 votes
2. RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`Command Injection - Generic · critical
   229 votes
3. CSRF leads to a stored self xssCross-site Scripting (XSS) - Reflected · low
   145 votes
4. Remote Code Execution on Git.imgur-dev.com Code Injection · critical
   119 votes
5. Unauthenticated Docker registryImproper Authentication - Generic
   92 votes
6. Password Reset Link not expiring after changing the email Leads To Account TakeoverImproper Authentication - Generic · medium
   87 votes
7. Login to any user account using other facebook app access token Improper Authentication - Generic
   76 votes
8. No length on passwordWeak Password Recovery Mechanism for Forgotten Password · medium
   74 votes
9. Bypass subscriptionBusiness Logic Errors · medium
   67 votes
10. Stored XSS in Post title (PoC)Cross-site Scripting (XSS) - Stored · medium
    63 votes
11. SSRF in https://imgur.com/vidgif/urlUncontrolled Resource Consumption
    52 votes
12. Reflected XSS in m.imgur.comCross-site Scripting (XSS) - Generic
    50 votes
13. Information disclosure (No rate limting in forgot password & other login)Information Disclosure
    30 votes
14. SSRF in imgur video GIF conversionServer-Side Request Forgery (SSRF) · high
    28 votes
15. De-anonymization Attack: Cross Site Information LeakageInformation Disclosure · medium
    23 votes
16. Xss on community.imgur.comCross-site Scripting (XSS) - Reflected · medium
    20 votes
17. Sourcemaps and Unminified Source Code Exposed on PagesImproper Access Control - Generic · medium
    19 votes
18. Go.imgur.com can be used to phish for account informationPhishing · low
    18 votes
19. Stored xss in ALBUM DESCRIPTION Cross-site Scripting (XSS) - Generic · medium
    18 votes
20. self-xss with ClickJacking can leads to account takeover in FirefoxCross-site Scripting (XSS) - DOM · low
    17 votes
21. Ability to login to the Nexus Repo Manager from https://nexus.imgur.com/ Path Traversal · medium
    17 votes
22. Reflected Flash XSS using swfupload.swf with an epileptic reloading to bypass the button-eventCross-site Scripting (XSS) - Generic
    16 votes
23. 8ybhy85kld9zp9xf84x6.imgur.com Subdomain TakeoverMisconfiguration · high
    15 votes
24. xss reflected on imgur.comCross-site Scripting (XSS) - Reflected
    15 votes
25. SSRF and local file read in video to gif converterServer-Side Request Forgery (SSRF)
    14 votes
26. Local file read in image editorCode Injection
    13 votes
27. SSRF / Local file enumeration / DoS due to improper handling of certain file formats by ffmpegCommand Injection - Generic
    8 votes
28. Stored XSS in albums on http://m.imgur.com/Cross-site Scripting (XSS) - Generic
    5 votes
29. XSS via React element spoofingCross-site Scripting (XSS) - Generic
    5 votes
30. Imgur dev environments facing the InternetInformation Disclosure
    4 votes
31. Persistent XSS in image titleCross-site Scripting (XSS) - Generic
    4 votes
32. risk of having secure=false in a crossdomain.xmlMemory Corruption - Generic
    3 votes
33. XSS m.imgur.comCross-site Scripting (XSS) - Generic
    3 votes
34. Big Bug in SSL : breach compression attack (CVE-2013-3587) affect imgur.comCryptographic Issues - Generic
    2 votes
35. XSS in imgur mobile 3Cross-site Scripting (XSS) - Generic
    2 votes
36. XSS in imgur mobileCross-site Scripting (XSS) - Generic
    2 votes
37. Crossdomain.xml settings on api.imgur.com too openMemory Corruption - Generic
    2 votes
38. "Sign me out everywhere" does not work for desktop sessionsCryptographic Issues - Generic
    2 votes
39. Attack User Privacy Settings - X-Frame-Options missing on m.imgur.com/user/username/settingsUI Redressing (Clickjacking)
    1 votes
40. Persistent XSS in https://p.imgur.com/albumview.gif and http://p.imgur.com/imageview.gif / post statisticsCross-site Scripting (XSS) - Generic
    1 votes
41. Csrf near report abuse meme Cross-Site Request Forgery (CSRF)
    1 votes
42. Content Sniffing not enabledCryptographic Issues - Generic
    1 votes