Browse / Mapbox

Mapbox

See its reports on the map

Attack surface: 157 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Mapbox

• Cross-site Scripting10
• Authentication3
• Information Disclosure3
• Code Execution2
• Open Redirect2
• Misconfiguration1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Test-scripts for postgis in mason-repository using unsafe unzip of content from unclaimed bucket creates potential RCE-issuesCommand Injection - Generic · critical
   209 votes
2. Admin Panel Accessed (OAuth Bypassed ) Command Injection - Generic · critical
   $4,000133 votes
3. Stored XSS | api.mapbox.com | IE 11 | Styles nameCross-site Scripting (XSS) - Stored · medium
   67 votes
4. Open Aws Amazon S3 BucketsImproper Authentication - Generic · medium
   $50039 votes
5. Reflected cross-site scripting (XSS) on api.tiles.mapbox.comCross-site Scripting (XSS) - Generic
   $1,00033 votes
6. Logging a user into attacker's account using password reset linkViolation of Secure Design Principles
   $60024 votes
7. Public access to objects in AWS S3 bucketInformation Disclosure · medium
   $75022 votes
8. XSS on www.mapbox.com/authorize/ because of open redirect at /core/oauth/authCross-site Scripting (XSS) - Generic
   19 votes
9. Reflected XSS via XML Namespace URI on https://go.mapbox.com/index.php/soap/Cross-site Scripting (XSS) - Reflected · medium
   17 votes
10. Node modules path disclosure due to lack of error handlingInformation Disclosure · low
    17 votes
11. Blind XSS in mapbox.com/contactCross-site Scripting (XSS) - Generic
    $75017 votes
12. XSS on www.mapbox.com/authorizeCross-site Scripting (XSS) - Generic
    15 votes
13. Stored xss in editor Cross-site Scripting (XSS) - Generic
    $1,00012 votes
14. Mapbox Android SDK uses Broadcast Receiver instead of Local Broadcast ManagerInformation Disclosure · low
    $1,00011 votes
15. Persistent cross-site scripting (XSS) in map attributionCross-site Scripting (XSS) - Generic
    $1,0007 votes
16. Disclosure of map informationImproper Authentication - Generic
    6 votes
17. Mapbox API Access Token with No Scope Can Read StylesImproper Authentication - Generic
    $2005 votes
18. Content Spoofing and Local Redirect in Mapbox StudioOpen Redirect
    5 votes
19. XSS in L.mapbox.shareControl in mapbox.jsCross-site Scripting (XSS) - Generic
    $1,0005 votes
20. null pointer dereference and segfault in tile-count-mergeNULL Pointer Dereference · high
    4 votes
21. Stored Cross-Site Scripting in Map Share PageCross-site Scripting (XSS) - Generic
    4 votes
22. Denial of service in account statistics endpointUncontrolled Resource Consumption
    3 votes