Browse / Kartpay

Kartpay

See its reports on the map

Attack surface: 19 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Kartpay

• Information Disclosure7
• Authentication4
• Misconfiguration3
• Open Redirect2
• Cross-site Scripting2
• Injection and Smuggling1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Duplicate Entry of email leads to 500 Server Error which disclosing the SQL Database table informationInformation Disclosure · critical
   39 votes
2. Being able to change account contents even after password changeInsufficient Session Expiration · medium
   32 votes
3. Host Header InjectionHTTP Request Smuggling · medium
   27 votes
4. bypass captcha in the form forgot passwordViolation of Secure Design Principles · low
   26 votes
5. Bypass _token in forms [Merchant.Kartpay.com ]Improper Authentication - Generic
   25 votes
6. SMTP Failure Leads to Chain of Internal System FailureInformation Disclosure · high
   23 votes
7. Disclosure of Merchant_id into the source code without entered OTP code leads to Victims MID takeover.Information Disclosure · critical
   19 votes
8. Application Design issue for Phone Number field in Registration.Information Exposure Through an Error Message · low
   15 votes
9. Referer issue in Kartpay.comOpen Redirect · medium
   13 votes
10. Captcha protection Bypass on Forgot password pageViolation of Secure Design Principles · low
    12 votes
11. Misconfiguration of Merchant id in jwt header + Weird Debug mode enabling behavior leads to exposed OTP of mobile number.Improper Authentication - Generic · high
    6 votes
12. URl redirection Open Redirect · medium
    4 votes
13. Full Path Disclosure of Server through 500 Server ErrorInformation Disclosure · low
    3 votes
14. Admin/Info lekageInformation Disclosure · low
    3 votes
15. Error Page Content Spoofing or Text Injection [https://vpn.kartpay.com/]Violation of Secure Design Principles
    3 votes
16. Reflected XSS on https://merchant.kartpay.com/payment_settings [status]Cross-site Scripting (XSS) - Reflected
    3 votes
17. Option method enabled in kartpay WebserversInformation Disclosure · low
    2 votes
18. XSS in https://merchant.kartpay.com/settlementsCross-site Scripting (XSS) - Generic
    1 votes