Browse / Lyst

Lyst

See its reports on the map

Attack surface: 1,582 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Lyst

• Misconfiguration3
• Access Control1
• Server-Side Request Forgery1
• Cross-Site Request Forgery1
• Open Redirect1
• Cross-site Scripting1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Subdomain takeover of storybook.lystit.comPrivilege Escalation · high
   $1,000163 votes
2. Web Cache poisoning attack leads to User information Disclosure and moreViolation of Secure Design Principles · medium
   45 votes
3. SSRF at iris.lystit.comServer-Side Request Forgery (SSRF) · low
   21 votes
4. Site configured improperly at subdomain of lyst.co.ukViolation of Secure Design Principles
   $10019 votes
5. CSRF - Adding unlimited number of saved items via GET requestCross-Site Request Forgery (CSRF) · medium
   $15019 votes
6. [https://█████████/]&&[https://█████████/] Open RedirectionOpen Redirect · medium
   18 votes
7. DOM XSS on http://talks.lystit.comCross-site Scripting (XSS) - DOM · low
   $10015 votes
8. Bypassing one-time checkout router page (revealing payment information)Information Disclosure · low
   12 votes
9. Mixed Active content issue on https://www.lyst.comViolation of Secure Design Principles · low
   12 votes