Browse / Moneybird

Moneybird

See its reports on the map

Attack surface: 32 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Moneybird

• Cross-site Scripting8
• Authentication4
• Open Redirect3
• Misconfiguration3
• Denial of Service2
• Code Execution2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Bypass password reset rate limit protection at moneybird.com/passwordsUncontrolled Resource Consumption · high
   164 votes
2. Enable 2FA without verifying the emailUncontrolled Resource Consumption · medium
   149 votes
3. Open Redirect through POST Request in OAuthOpen Redirect · low
   34 votes
4. No rate LimitImproper Restriction of Authentication Attempts · low
   32 votes
5. Access control issue on invoice documents downloading feature.Improper Access Control - Generic · low
   29 votes
6. Open Redirection while saving User account Settings Open Redirect · medium
   28 votes
7. IDOR in https://moneybird.com/user/accountant_company/edit(change company name)Insecure Direct Object Reference (IDOR) · low
   22 votes
8. Bypass of Rate limiting in secure_session endpoint's password input will lead to user password disclosure Improper Restriction of Authentication Attempts
   19 votes
9. Pending MFA logins aren't immediatly expired after a password changeSession Fixation · low
   15 votes
10. Employees with Any Permissions Can Create App with Full Permissions and Perform any API ActionImproper Authentication - Generic
    15 votes
11. Stored XSS at MoneybirdCross-site Scripting (XSS) - Stored · medium
    13 votes
12. Stored Cross Site Scripting in Customer NameCross-site Scripting (XSS) - Generic · low
    13 votes
13. Logging out any userViolation of Secure Design Principles
    13 votes
14. XXE issueCommand Injection - Generic
    13 votes
15. Stored XSS on add projectCross-site Scripting (XSS) - Stored · medium
    12 votes
16. [STORED XSS] in debtor reports of ,,invoices''Cross-site Scripting (XSS) - Generic
    9 votes
17. Stored XSS thru SVG uploadCross-site Scripting (XSS) - Generic
    9 votes
18. Stored XSS in Financial Account executing in Bank tabCross-site Scripting (XSS) - Generic
    7 votes
19. Moneybird customers invoices leak in cacheable urlsInformation Disclosure · low
    6 votes
20. Webhook allows sending payload using insecure HTTP protocolCryptographic Issues - Generic
    6 votes
21. Open Redirect vulnerability in moneybird.comOpen Redirect
    6 votes
22. Malicious File UploadViolation of Secure Design Principles
    5 votes
23. Content Spoofing In MoneybirdViolation of Secure Design Principles
    4 votes
24. CSV Injection with the CSV export featureCommand Injection - Generic
    3 votes
25. [Stored Cross-Site-Scripting] When search about Incoming ( Manual Jurnal )Cross-site Scripting (XSS) - Generic
    2 votes
26. Reflected XSS in Backend searchCross-site Scripting (XSS) - Generic
    2 votes
27. information disclose Information Disclosure
    1 votes