Browse / PortSwigger Web Security

PortSwigger Web Security

See its reports on the map

Attack surface: 928 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to PortSwigger Web Security

• Information Disclosure6
• Cryptography4
• Cross-site Scripting4
• Business Logic4
• Access Control4
• Code Execution3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingPath Traversal · high
   $5,000176 votes
2. RCE of Burp Scanner / Crawler via Clickjacking Command Injection - Generic · high
   $3,000172 votes
3. [portswigger.net] Path Traversal al /cms/audioitemsPath Traversal · high
   146 votes
4. DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolServer-Side Request Forgery (SSRF)
   144 votes
5. Build fetches jars over HTTPMan-in-the-Middle · medium
   $1,000135 votes
6. HTML Injection in Swing can disclose netNTLM hash or cause DoSInformation Disclosure · medium
   $1,000117 votes
7. CSP bypass on PortSwigger.net using Google script resourcesCross-site Scripting (XSS) - Reflected · medium
   113 votes
8. HTML Injection in DAST Trial Request Form Confirmation Email – PortSwiggerCross-site Scripting (XSS) - Generic · low
   $20093 votes
9. Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumptionImproper Authentication - Generic · low
   $20092 votes
10. Burp Suite extensions can execute arbitrary codeInformativeCode Injection · high
    85 votes
11. cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-partyInformation Disclosure · low
    $20081 votes
12. SMTP interaction theft via MITMCryptographic Issues - Generic · medium
    78 votes
13. Title: Deceptive Manipulation of HTTP to HTTPS with VPN in Burp SuiteInformativeCleartext Transmission of Sensitive Information · medium
    71 votes
14. Incorrect logic when buy one more license which may lead to extend the expire date of existing licenseInformativeBusiness Logic Errors
    61 votes
15. Privilege Escalation by abusing non-existent path. (Windows)DuplicatePrivilege Escalation · medium
    59 votes
16. Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authenticationCross-site Scripting (XSS) - Generic · medium
    $1,00058 votes
17. A user with only [MODIFY_SETTINGS] permmision could takeover any user accountsImproper Access Control - Generic · low
    51 votes
18. RCE in 'Copy as Node Request' BApp via code injectionCode Injection
    51 votes
19. CSP Bypass and escalation of https://hackerone.com/reports/2279346N/ABusiness Logic Errors · high
    48 votes
20. Changing the administrator password via admin console does not invalidate other sessionsImproper Authentication - Generic · low
    41 votes
21. burp does not validate the common name of the presented collaborator server certificateMan-in-the-Middle · medium
    $1,50039 votes
22. Redirection in Repeater & Intruder TabOpen Redirect · low
    $15036 votes
23. XSS in IE11 on portswigger.net via FlashCross-site Scripting (XSS) - Generic
    33 votes
24. JSBeautifier BApp: Race condition leads to memory disclosureMemory Corruption - Generic · high
    32 votes
25. UI Consent Bypass via Comma Injection in `addAutoApproveTarget` — User-Approval Dialog and Persistence Layer Disagree on Target Scope, Yielding AuthenLLM09:2025 Misinformation
    28 votes
26. The role "CI-driven scan initiator" provides excessive read accessPrivilege Escalation · low
    28 votes
27. Clicking "http://burp" hyperlink on FireFox CA Installation guide redirects to "burp.com" (unclaimed website).InformativeOpen Redirect · low
    22 votes
28. Incomplete fix for CVE-2022-35406: meta-redirect content-type check bypassable via parameter injectionInformativeOpen Redirect · high
    18 votes
29. Business Logic, currency arbitrage - Possibility to pay less than the price in USDInformativeBusiness Logic Errors · medium
    18 votes
30. Information disclosure on error messageInformativeInformation Exposure Through an Error Message · low
    18 votes
31. DLL Hijacking in Burp Suite Pro 2.0.19 InstallerInformativePrivilege Escalation · medium
    17 votes
32. Leak of Platform Authentication credentials via RepeaterInformation Disclosure · low
    $20015 votes
33. No Rate Limit On Regenerate Password on PortswiggerInformativeImproper Restriction of Authentication Attempts
    11 votes
34. Activat burp suite pro with the old license after transfared to anothe accountN/ABusiness Logic Errors
    6 votes
35. HTTP OPTION Method is Enabled on portswigger.net N/AViolation of Secure Design Principles · low
    6 votes
36. Order-phishing via Payment ID URLInformativeCross-Site Request Forgery (CSRF) · low
    6 votes
37. Browser Self XSS Protection not implementedN/AInformation Disclosure
    5 votes
38. Misconfiguration: Missing Custom Error Page (CWE-12 & CWE-756)InformativeMisconfiguration
    4 votes
39. Email SpoofingN/AViolation of Secure Design Principles · low
    3 votes
40. Improper Certificate ValidationInformativeImproper Certificate Validation · low