Browse / PortSwigger Web Security

PortSwigger Web Security

See its reports on the map

Attack surface: 928 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to PortSwigger Web Security

• Information Disclosure6
• Cryptography4
• Cross-site Scripting4
• Business Logic4
• Access Control4
• Code Execution3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingPath Traversal · high
   $5,000176 votes
2. RCE of Burp Scanner / Crawler via Clickjacking Command Injection - Generic · high
   $3,000172 votes
3. [portswigger.net] Path Traversal al /cms/audioitemsPath Traversal · high
   146 votes
4. DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolServer-Side Request Forgery (SSRF)
   144 votes
5. Build fetches jars over HTTPMan-in-the-Middle · medium
   $1,000135 votes
6. HTML Injection in Swing can disclose netNTLM hash or cause DoSInformation Disclosure · medium
   $1,000117 votes
7. CSP bypass on PortSwigger.net using Google script resourcesCross-site Scripting (XSS) - Reflected · medium
   113 votes
8. HTML Injection in DAST Trial Request Form Confirmation Email – PortSwiggerCross-site Scripting (XSS) - Generic · low
   $20093 votes
9. Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumptionImproper Authentication - Generic · low
   $20092 votes
10. cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-partyInformation Disclosure · low
    $20081 votes
11. SMTP interaction theft via MITMCryptographic Issues - Generic · medium
    78 votes
12. Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authenticationCross-site Scripting (XSS) - Generic · medium
    $1,00058 votes
13. A user with only [MODIFY_SETTINGS] permmision could takeover any user accountsImproper Access Control - Generic · low
    51 votes
14. RCE in 'Copy as Node Request' BApp via code injectionCode Injection
    51 votes
15. Changing the administrator password via admin console does not invalidate other sessionsImproper Authentication - Generic · low
    41 votes
16. burp does not validate the common name of the presented collaborator server certificateMan-in-the-Middle · medium
    $1,50039 votes
17. Redirection in Repeater & Intruder TabOpen Redirect · low
    $15036 votes
18. XSS in IE11 on portswigger.net via FlashCross-site Scripting (XSS) - Generic
    33 votes
19. JSBeautifier BApp: Race condition leads to memory disclosureMemory Corruption - Generic · high
    32 votes
20. UI Consent Bypass via Comma Injection in `addAutoApproveTarget` — User-Approval Dialog and Persistence Layer Disagree on Target Scope, Yielding AuthenLLM09:2025 Misinformation
    28 votes
21. The role "CI-driven scan initiator" provides excessive read accessPrivilege Escalation · low
    28 votes
22. Leak of Platform Authentication credentials via RepeaterInformation Disclosure · low
    $20015 votes