Browse / PayPal

PayPal

See its reports on the map

Attack surface: 17,146 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to PayPal

• Cross-site Scripting3
• Injection and Smuggling2
• Code Execution2
• Open Redirect2
• Authentication1
• Denial of Service1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Bypass for #488147 enables stored XSS on https://paypal.com/signin againHTTP Request Smuggling · high
   $20,0002,687 votes
2. Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordMissing Authentication for Critical Function · high
   $15,3001,409 votes
3. RCE via npm misconfig -- installing internal libraries from the public registryCode Injection · critical
   $30,000946 votes
4. DoS on PayPal via web cache poisoningUncontrolled Resource Consumption · medium
   $9,700851 votes
5. IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersInsecure Direct Object Reference (IDOR) · high
   $10,500797 votes
6. Stored XSS on https://paypal.com/signin via cache poisoningHTTP Request Smuggling · high
   $18,900685 votes
7. [PayPal Android] Remote theft of user session using push_notification_webview deeplinkOpen Redirect · medium
   188 votes
8. [Venmo Android] Remote theft of user sessionOpen Redirect · medium
   151 votes
9. Reflected XSS at https://www.paypal.com/ppcreditapply/da/usCross-site Scripting (XSS) - Reflected · medium
   137 votes
10. XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Cross-site Scripting (XSS) - Generic · medium
    100 votes
11. Unsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]Deserialization of Untrusted Data · medium
    93 votes
12. XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victimCross-Site Request Forgery (CSRF) · medium
    $3,50081 votes
13. Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/ Cross-site Scripting (XSS) - Reflected · medium
    54 votes