Browse / Mars

Mars

See its reports on the map

Attack surface: 3,528 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Mars

• Information Disclosure15
• Cross-site Scripting13
• Insecure Direct Object Reference7
• Access Control7
• Cross-Site Request Forgery6
• SQL Injection5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Account Takeover in Password Reset FunctionAuthentication Bypass · critical
   105 votes
2. Reflected HTML Injection via contact (faq) search parameter on ██████████Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
   103 votes
3. █████████ when adding branches to your accountInsecure Direct Object Reference (IDOR) · critical
   98 votes
4. Reflected HTML Injection via contact (faq) search parameter on ███]=Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
   82 votes
5. Unrestricted File Upload at ██████████Unrestricted Upload of File with Dangerous Type · critical
   78 votes
6. sqli on █████████ search functionalitySQL Injection · medium
   72 votes
7. RXSS on ██████ via customerId parameterCross-site Scripting (XSS) - Reflected · medium
   71 votes
8. CVE-█████-35813 in █████Relative Path Traversal · critical
   71 votes
9. Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314Information Disclosure · medium
   67 votes
10. Upload profile photo and Pets addition - IDORInsecure Direct Object Reference (IDOR) · high
    66 votes
11. Bug Report #23JAN136 (subdomain takeover via shopify )Privilege Escalation · high
    63 votes
12. SQLi At `███████` via `theme_name` SQL Injection · critical
    62 votes
13. Attacker can add two free bags offered by the site at the same time.Business Logic Errors · medium
    62 votes
14. Insecure API Response Leads to Disclosure of Hashed PasswordsInformation Disclosure · medium
    61 votes
15. CSRF to delete a pet on ██████Cross-Site Request Forgery (CSRF) · low
    61 votes
16. insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)Deserialization of Untrusted Data · critical
    59 votes
17. 0 Click account takeover via timed requests to ███████forgot-password (single-packet attack)Use of a Broken or Risky Cryptographic Algorithm · high
    58 votes
18. [XSS] Reflected XSS via POST request in (███████)Cross-site Scripting (XSS) - Reflected · medium
    54 votes
19. unauthorized access and add user and change personal information all usersImproper Access Control - Generic · critical
    54 votes
20. change part of personal information all usersImproper Access Control - Generic · critical
    53 votes
21. RXSS on ████ via configUrl parameterCross-site Scripting (XSS) - Reflected · low
    53 votes
22. Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████Improper Authentication - Generic · critical
    53 votes
23. phpinfo() exposed on ██████████Misconfiguration · medium
    51 votes
24. Bug Report #23JAN135 (subdomain takeover via shopify )Privilege Escalation · high
    50 votes
25. Publicly accessible `█████████` endpoint exposing internal user identifiers and email addressesInformation Disclosure · medium
    49 votes
26. Sqli on ██████ search functionalitySQL Injection · medium
    47 votes
27. Datadog api keys exposed can be used to do all the read and write access to the instanceInformation Disclosure · critical
    47 votes
28. unsubscribe anyone from all ████████ emails @ █████Improper Access Control - Generic · low
    45 votes
29. IDOR to account takeover on POST to █████████ by changing member_id parameterInsecure Direct Object Reference (IDOR) · critical
    45 votes
30. IDOR in one subdomain of █████████ -> change information of pets without athorization!Insecure Direct Object Reference (IDOR) · medium
    45 votes
31. SQLi at █████ parameterSQL Injection · critical
    42 votes
32. Account takeover using reset password linkOpen Redirect · medium
    41 votes
33. debug.log leaked [█████████]Information Disclosure · low
    40 votes
34. Users Data Exposure via Insecure EndpointInformation Disclosure · medium
    40 votes
35. RXSS on stores on *█████████/visitorRegistration.pml via destination parameterCross-site Scripting (XSS) - Reflected · medium
    40 votes
36. subdomain takeover at █████████Misconfiguration · high
    40 votes
37. Client Side Template Injection to Stored XSS in Image CollectionCross-site Scripting (XSS) - Stored · high
    39 votes
38. RXSS on ████ via q parameterCross-site Scripting (XSS) - Reflected · low
    39 votes
39. debug.log File Exposure that exposes (user/████) username and password at █████████Cleartext Storage of Sensitive Information · high
    39 votes
40. RXSS in ███ via S parameter Cross-site Scripting (XSS) - Reflected · medium
    38 votes
41. massive PII leakage for ███████Insecure Storage of Sensitive Information · medium
    36 votes
42. phpinfo() exposed on ██████████Misconfiguration
    36 votes
43. Sensitive information exposed at [███] via /export_panelists_to_xlsx endpointCleartext Storage of Sensitive Information · medium
    35 votes
44. Reflected xss on ████████ Cross-site Scripting (XSS) - Reflected · medium
    33 votes
45. Sensitive Information Exposed at █████Information Disclosure · high
    33 votes
46. Order More Than Maximum Allowed QuantityBusiness Logic Errors
    32 votes
47. CSRF in Delete Pet FunctionCross-Site Request Forgery (CSRF) · medium
    32 votes
48. ████ ' can change any account email and cannot retrieve his account and access it ' at ███Insecure Direct Object Reference (IDOR) · high
    32 votes
49. CVE-2022-21371: Oracle WebLogic Server Local File InclusionPath Traversal · high
    30 votes
50. ███████ - Publicly Accessible public_html Directory Exposing WordPress ConfigurationInformation Disclosure · medium
    29 votes
51. CSRF resulting in adding pet at ███████Cross-Site Request Forgery (CSRF) · low
    29 votes
52. Blind SQL Injection on █████ via URI PathSQL Injection · critical
    29 votes
53. No CSRF protection when adding an item to cartCross-Site Request Forgery (CSRF) · low
    29 votes
54. No Rate Limiting on Password Attempts After Insecure Registration Flow cause ATOImproper Restriction of Authentication Attempts · medium
    28 votes
55. Customer Data Exposure via Insecure Endpoint of couponInformation Disclosure · medium
    28 votes
56. sensitive data-creds for database - private keyMissing Encryption of Sensitive Data · medium
    27 votes
57. ████ ' can add animal to other account ' at ██████Insecure Direct Object Reference (IDOR) · medium
    27 votes
58. **"CSRF Vulnerability in ███████ Website Allows Attackers to Change User Profile Picture at ███████"**Cross-Site Request Forgery (CSRF) · medium
    26 votes
59. Reflected XSS on formaction parameterCross-site Scripting (XSS) - Reflected · medium
    25 votes
60. CSRF to delete a petCross-Site Request Forgery (CSRF) · medium
    25 votes
61. Information Exposure due to enabled debug modeInformation Disclosure · low
    22 votes
62. ███████ ' can delete any animal from other account ' at ██████████ Insecure Direct Object Reference (IDOR) · medium
    21 votes
63. ' Full Account Takeover ' at █████Improper Access Control - Generic · critical
    19 votes
64. Stored XSS via ' profile ' at ███Cross-site Scripting (XSS) - Stored · medium
    16 votes
65. CRLF Inection at `██████████`CRLF Injection · low
    14 votes
66. Information Exposure Through Directory ListingInformation Exposure Through Directory Listing · high
    13 votes
67. Jolokia Reflected XSS Cross-site Scripting (XSS) - Reflected · medium
    13 votes
68. Google dork lead to unsubscribe anyone from all Banfield emailsImproper Access Control - Generic · low
    12 votes