Browse / Reddit

Reddit

See its reports on the map

Attack surface: 23,159 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Reddit

• Access Control14
• Authentication13
• Cross-site Scripting10
• Insecure Direct Object Reference6
• Business Logic5
• Information Disclosure4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. read and message other user's messagesN/AInsecure Direct Object Reference (IDOR) · critical
   14 votes
2. XSSN/ACross-site Scripting (XSS) - Generic
   10 votes
3. critical file found etc/passwd on www.reddit.comN/AInformation Disclosure · high
   10 votes
4. XSS in redditmedia.com can compromise data of reddit.comN/ACross-site Scripting (XSS) - Stored · medium
   10 votes
5. sensitive data exposureN/AInsecure Storage of Sensitive Information · high
   5 votes
6. Broken Authendication And Session ManagementN/AImproper Access Control - Generic
   5 votes
7. Reflected XSS via File UploadN/ACross-site Scripting (XSS) - Reflected · medium
   4 votes
8. CVE-2020-11022N/ACross-site Scripting (XSS) - Reflected · medium
   3 votes
9. Email Verification Bypass And Get access to user's private invitation.N/ABusiness Logic Errors · medium
   3 votes
10. Several Subdomains TakeoverN/Ahigh
    2 votes
11. Vulnerability Name: URL Redirection / Unvalidate Open RedirectN/AOpen Redirect
    2 votes
12. Content Spoofing/Text Injection at https://gateway-production.dubsmash.comN/AUser Interface (UI) Misrepresentation of Critical Information
    1 votes
13. Content SpoofingN/APhishing · low
    1 votes