Browse / Liberapay

Liberapay

See its reports on the map

Attack surface: 36 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Liberapay

• Information Disclosure8
• Authentication7
• Misconfiguration7
• Cross-Site Request Forgery6
• Business Logic6
• Access Control4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donatImproper Authentication - Generic · medium
   $10068 votes
2. Liberapay member team twitter account broken Link Hijacking via Expired Twitter Account LinkOpen Redirect
   65 votes
3. Unsafe yaml load can lead to remote code executionDeserialization of Untrusted Data · low
   55 votes
4. Avatar URL is exposed in patron export for secret donationsPrivacy Violation · medium
   48 votes
5. Login CSRF : Login Authentication Flaw on https://liberapay.com/Phishing · low
   46 votes
6. Exploiting JSONP callback on /username/charts.json endpoint leads to information disclosure despite user's privacy settingsInformation Disclosure · medium
   35 votes
7. Email Address Exposure via Gratipay Migration ToolInsecure Direct Object Reference (IDOR) · medium
   $10034 votes
8. Origin IP found, Cloudflare bypassedImproper Access Control - Generic · medium
   34 votes
9. Import of repositories from GitHub is tied to username instead of immutable IDImproper Access Control - Generic · low
   22 votes
10. Unsafe deserialization in Libera Pay allows to escalate a SQL injection to Remote Command ExecutionDeserialization of Untrusted Data
    18 votes
11. Failure to Invalid Session after Password ChangeViolation of Secure Design Principles · low
    16 votes
12. Authenticated reflected XSS on liberapay.com via the back_to parameter when leaving a team.Cross-site Scripting (XSS) - Reflected · low
    16 votes
13. Private target account appears in search resultsPrivacy Violation
    14 votes
14. Invalidate session after password resetViolation of Secure Design Principles · low
    10 votes
15. Reauthentication for changing password bypassImproper Authentication - Generic · low
    10 votes
16. Anyone can register organization legal type as "Soletrader"Resource Injection
    6 votes
17. Missing back-end user input validation can lead to DOS flawBusiness Logic Errors
    5 votes