Browse / OpenMage

OpenMage

See its reports on the map

Attack surface: 7 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to OpenMage

• Business Logic1
• Misconfiguration1
• Cross-Site Request Forgery1
• Information Disclosure1
• Denial of Service1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Sharing products with Mail allows phishing attacks due to misconfiguration.Business Logic Errors · medium
   38 votes
2. No error thrown when IDOR attempted while editing addressMisconfiguration · medium
   33 votes
3. CSRF in changing password after using reset password linkCross-Site Request Forgery (CSRF) · low
   24 votes
4. Very long names on demo.openmage.org could redirect victim users to malicious url redirects via email contacts.Privacy Violation · medium
   14 votes
5. No Limit on Email SubscriptionAllocation of Resources Without Limits or Throttling · low
   12 votes