Browse / Infogram

Infogram

See its reports on the map

Attack surface: 332 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Infogram

• Cross-site Scripting15
• Authentication7
• Misconfiguration7
• Information Disclosure4
• Access Control3
• Server-Side Request Forgery3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. LFI through the MySQL connectionInformation Disclosure · high
   47 votes
2. Privilege escalation allows to use iframe functionality w/o upgradePrivilege Escalation
   35 votes
3. Bypass for blind SSRF #281950 and #287496Server-Side Request Forgery (SSRF) · low
   28 votes
4. Memory Corruption via Large PixelsClassic Buffer Overflow · medium
   25 votes
5. Stored XSS in infogram.com via language Cross-site Scripting (XSS) - Stored · high
   20 votes
6. Password Reset Token Not Expired Weak Password Recovery Mechanism for Forgotten Password · high
   20 votes
7. Internal Ports Scanning via Blind SSRFInformation Disclosure
   16 votes
8. User account blocking by Internal Server errorhigh
   15 votes
9. No Rate Limit on account deletion request(Leads to huge email flooding/email bombing)Violation of Secure Design Principles · low
   15 votes
10. No Rate limit on Password Reset FunctionImproper Authentication - Generic · medium
    13 votes
11. Internal Ports Scanning via Blind SSRF (URL Redirection to beat filter)Server-Side Request Forgery (SSRF) · low
    12 votes
12. Server Side Request Forgery on JSON FeedServer-Side Request Forgery (SSRF) · medium
    12 votes
13. Weak Password Policy on SignupViolation of Secure Design Principles · low
    12 votes
14. possibility to create account without usernameViolation of Secure Design Principles · medium
    11 votes
15. CORS on (ws.infogram.com)Improper Access Control - Generic · low
    11 votes
16. Stored XSS in the Custom Logo link (non-Basic plan required)Cross-site Scripting (XSS) - Stored · medium
    11 votes
17. Email notification is not being sent while changing passwordsViolation of Secure Design Principles · low
    11 votes
18. XSS on infogram.comCross-site Scripting (XSS) - Stored · high
    10 votes
19. Bypass insecure password validationImproper Authentication - Generic · low
    9 votes
20. Stored Cross-Site scripting in the infographics using linksCross-site Scripting (XSS) - Stored · medium
    9 votes
21. Application Vulnerable to CSRF - Remove Invited userCross-Site Request Forgery (CSRF) · medium
    8 votes
22. Incorrect Functionality of Password reset linksViolation of Secure Design Principles · low
    8 votes
23. Stored XSS in content when Graph is created via APICross-site Scripting (XSS) - Stored · medium
    7 votes
24. Sensitive information is publicly available Cleartext Storage of Sensitive Information · medium
    7 votes
25. Stored Cross-Site scripting in the infographics using Data Objects linksCross-site Scripting (XSS) - Stored · medium
    7 votes
26. Bypass to report #280389 [Thinking The issue is not fixed Yet]Improper Authentication - Generic · medium
    6 votes
27. Is the 504 Gateway Time-out error ok?Uncontrolled Resource Consumption · low
    6 votes
28. New team invitation functionality allows extend team without upgradePrivilege Escalation · medium
    6 votes
29. Persistent XSS in share buttonCross-site Scripting (XSS) - Stored · medium
    6 votes
30. Stored XSS On Wordpress Infogram pluginCross-site Scripting (XSS) - Stored · medium
    6 votes
31. Multiple xss on infogram templatesCross-site Scripting (XSS) - Stored
    6 votes
32. XSS when SharedCross-site Scripting (XSS) - Reflected · medium
    6 votes
33. Report Design Critical Stored DOM XSS Vulnerability Cross-site Scripting (XSS) - Stored · critical
    6 votes
34. Tabnabbing via window.openerViolation of Secure Design Principles · low
    6 votes
35. HTML injection Cross-site Scripting (XSS) - Generic
    5 votes
36. XSS on Report ClassicCross-site Scripting (XSS) - Stored
    5 votes
37. Outdated jQuery Version
    5 votes
38. User EnumerationInformation Disclosure · low
    5 votes
39. Javascript Payload reflected Back in Report Embed CodeCross-site Scripting (XSS) - Stored · low
    4 votes
40. Non Critical Code Quality Bug / Self XSS on Map EditorCross-site Scripting (XSS) - Stored · medium
    4 votes
41. SPF MisconfigurationViolation of Secure Design Principles · low
    4 votes
42. Bruteforcing CouponsBusiness Logic Errors
    3 votes