Browse / Rockstar Games

Rockstar Games

See its reports on the map

Attack surface: 496 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Rockstar Games

• Cross-site Scripting33
• Information Disclosure22
• Cross-Site Request Forgery16
• Misconfiguration6
• Access Control5
• Code Execution5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. The return of the ＜Cross-site Scripting (XSS) - Stored · high
   $1,000576 votes
2. Account Takeover using Linked Accounts due to lack of CSRF protectionCross-Site Request Forgery (CSRF) · high
   238 votes
3. Stealing Facebook OAuth Code Through Screenshot viewerInformation Disclosure · medium
   200 votes
4. XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker)Cross-site Scripting (XSS) - Stored · medium
   194 votes
5. xss on https://www.rockstargames.com/GTAOnline/jp/screens/ Cross-site Scripting (XSS) - Generic · medium
   159 votes
6. Access to the business emails of Rockstar Support agents through the support platformImproper Access Control - Generic · low
   $550151 votes
7. Unserialize leading to arbitrary PHP function invokeCode Injection · critical
   119 votes
8. Stored XSS in Snapmatic + R★Editor commentsCross-site Scripting (XSS) - Stored · high
   118 votes
9. SocialClub Account Take Over Through Import Friends featureCross-Site Request Forgery (CSRF) · high
   116 votes
10. Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.Cross-Site Request Forgery (CSRF) · medium
    112 votes
11. CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/Cross-Site Request Forgery (CSRF) · medium
    104 votes
12. Password and mail address stored unencrypted in memory - Rockstar Game LauncherMissing Encryption of Sensitive Data · medium
    $75091 votes
13. Open redirect vulnerabilityOpen Redirect · low
    $25083 votes
14. Blind SSRF in emblem editor (2)Server-Side Request Forgery (SSRF) · medium
    $1,50083 votes
15. LFI and SSRF via XXE in emblem editorXML External Entities (XXE) · critical
    $1,50079 votes
16. Cache Poisoning DoS on updates.rockstargames.comViolation of Secure Design Principles · medium
    77 votes
17. XSS on rockstargames.comCross-site Scripting (XSS) - Generic · high
    $50075 votes
18. Facebook OAuth Code Theft through referer leakage on support.rockstargames.comCross-Site Request Forgery (CSRF) · medium
    71 votes
19. Insecure Direct Object Reference allows Crew Invite deletionInsecure Direct Object Reference (IDOR) · medium
    67 votes
20. Ticket Trick Attack allows access to ████████' workspacesImproper Access Control - Generic · high
    66 votes
21. Unquoted Service Path in "Rockstar Game Library Service"Privilege Escalation · medium
    60 votes
22. Brute Force against VMware HorizonImproper Restriction of Authentication Attempts · low
    $25053 votes
23. Social Club Account Takeover Via RGL And Steam/Epic Linked AccountPrivilege Escalation · high
    53 votes
24. SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCEServer-Side Request Forgery (SSRF) · high
    $1,50052 votes
25. Improper Authentication inside the Rockstar Games Launcher which leads to Account takeover to some extendImproper Authentication - Generic · high
    $75051 votes
26. Bypass CAPTCHA protectionImproper Authentication - Generic · medium
    51 votes
27. Open Redirection effects autodiscover.rockstargames.comOpen Redirect · low
    49 votes
28. Stored XSS on support.rockstargames.comCross-site Scripting (XSS) - Stored · medium
    $1,00049 votes
29. full path disclosure on www.rockstargames.com via apache filename brute forcingInformation Disclosure · low
    48 votes
30. DOM XSS on https://www.rockstargames.com/GTAOnline/feedbackCross-site Scripting (XSS) - DOM · medium
    46 votes
31. DOM based XSS on /GTAOnline/tw/starterpack/Cross-site Scripting (XSS) - DOM · medium
    46 votes
32. Stored XSS in profile activity feed messagesCross-site Scripting (XSS) - Stored · medium
    $1,00045 votes
33. Exposed CDN access token allows modification of all newly uploaded Snapmatic photosImproper Access Control - Generic · medium
    41 votes
34. CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php'Cross-Site Request Forgery (CSRF) · medium
    40 votes
35. Smuggle SocialClub's Facebook OAuth Code via Referer LeakageInformation Disclosure · medium
    $75039 votes
36. <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->Cross-Site Request Forgery (CSRF) · critical
    39 votes
37. Image Injection vulnerability on screenshot-viewer/responsive/image may allow Facebook OAuth token theft.Information Disclosure · medium
    36 votes
38. Exploiting Misconfigured CORS to Steal User InformationInformation Disclosure · high
    $50036 votes
39. Stored XSS on profile page via Steam display nameCross-site Scripting (XSS) - Stored · high
    $1,25035 votes
40. DOM Based xss on https://www.rockstargames.com/ ( 1 )Cross-site Scripting (XSS) - DOM · high
    34 votes
41. stored XSS (angular injection) in support.rockstargames.com using zendesk register form via name parameterCross-site Scripting (XSS) - Stored · high
    $1,00031 votes
42. Stored XSS in snapmatic commentsCross-site Scripting (XSS) - Stored · medium
    $1,00030 votes
43. Image Injection/XSS vulnerability affecting https://www.rockstargames.com/newswire/articleCross-Site Request Forgery (CSRF) · medium
    29 votes
44. CSRF Vulnerability on post creation page /community/create-post.jsonCross-Site Request Forgery (CSRF) · low
    29 votes
45. Uninstalling Rockstar Games Launcher for Windows (64-bit), then reinstalling keeps you logged in without authenticationPrivacy Violation · low
    $25028 votes
46. CSRF Vulnerability allows attackers to steal SocialClub private token.Cross-Site Request Forgery (CSRF) · high
    28 votes
47. XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.jsCross-site Scripting (XSS) - Reflected · medium
    28 votes
48. DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax requestCross-site Scripting (XSS) - Generic · medium
    27 votes
49. Reflected XSS in /Videos/ via calling a callback http://www.rockstargames.com/videos/#/?lb=Cross-site Scripting (XSS) - Generic · medium
    27 votes
50. Reflected XSS via #tags= while using a callback in newswire http://www.rockstargames.com/newswireCross-site Scripting (XSS) - Generic · medium
    26 votes
51. Stored XSS on member post feedCross-site Scripting (XSS) - Stored · high
    $1,00025 votes
52. Login form on non-HTTPS pageCleartext Transmission of Sensitive Information · high
    $35024 votes
53. Open redirect on https://signin.rockstargames.com/connect/authorize/rsgOpen Redirect · low
    23 votes
54. Open redirect in https://www.rockstargames.com/GTAOnline/restricted-content/agegate/form may lead to Facebook OAuth token theftOpen Redirect · low
    23 votes
55. Race condition vulnerability on "This Rocks" button.Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium
    23 votes
56. use of unsafe host header leads to open redirectViolation of Secure Design Principles · low
    23 votes
57. Minor Account Privacy can Set to Everyone.Insecure Direct Object Reference (IDOR) · low
    22 votes
58. Information Disclosure in https://www.rockstargames.com/searchSQL Injection · low
    22 votes
59. Reflected XSS via Double EncodingCross-site Scripting (XSS) - Reflected · medium
    $50022 votes
60. phpinfo() on graph.rockstargames.com exposes sensitive informationInformation Disclosure · low
    20 votes
61. [IMP] - Blind XSS in the admin panel for reviewing commentsCross-site Scripting (XSS) - Generic · medium
    $65020 votes
62. Stored XSS with CRLF injection via post message to user feedCross-site Scripting (XSS) - Stored · medium
    19 votes
63. Comments Denial of Service in socialclub.rockstargames.comCode Injection · medium
    19 votes
64. Stored XSS via Send crew inviteCross-site Scripting (XSS) - Stored · medium
    18 votes
65. Table and Column ExposureInformation Exposure Through an Error Message · low
    $15018 votes
66. Dom based xss on https://www.rockstargames.com/ via `returnUrl` parameterCross-site Scripting (XSS) - DOM · medium
    17 votes
67. SocialClub's Facebook OAuth Theft through Warehouse XSS.Cross-Site Request Forgery (CSRF) · medium
    17 votes
68. Reflected XSS in reddeadredemption Site located at www.rockstargames.com/reddeadredemptionCross-site Scripting (XSS) - Generic · medium
    17 votes
69. Open redirect affecting m.rockstargames.com/Open Redirect · medium
    16 votes
70. Dom based xss on /reddeadredemption2/br/videosCross-site Scripting (XSS) - DOM · medium
    16 votes
71. Client-side Template Injection in Search, user email/token leak and maybe sandbox escapeCode Injection · medium
    15 votes
72. Control Character Injection In MessagesImproper Authentication - Generic · low
    15 votes
73. csrf in https://www.rockstargames.com/reddeadonline/feedback/submit.jsonCross-Site Request Forgery (CSRF) · low
    14 votes
74. Image Injection vulnerability in www.rockstargames.com/IV/screens/1280x720Image.htmlCross-Site Request Forgery (CSRF) · medium
    14 votes
75. Image Injection on www.rockstargames.com/screenshot-viewer/responsive/image may allow facebook oauth token theft.Information Disclosure · medium
    14 votes
76. Warehouse dom based xss may lead to Social Club Account Taker Over.Cross-site Scripting (XSS) - DOM · high
    13 votes
77. DOM BASED XSS ON https://www.rockstargames.com/GTAOnline/features Cross-site Scripting (XSS) - DOM · high
    13 votes
78. Source Code Disclosure (CGI)Information Disclosure · medium
    $15013 votes
79. Full path Disclosure in Rockstargames.com██████████ Information Disclosure · low
    13 votes
80. dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass)Cross-site Scripting (XSS) - DOM · medium
    12 votes
81. Flash injection vulnerability on /IV/imgPlayer/imageEmbed.swfCross-site Scripting (XSS) - Generic · medium
    11 votes
82. Found CSRF Vulnerability in https://support.rockstargames.com/Cross-Site Request Forgery (CSRF) · low
    $15011 votes
83. Leak IP internalInformation Disclosure · low
    11 votes
84. Stored XSS on support.rockstargames.comCross-site Scripting (XSS) - Stored · medium
    $1,00011 votes
85. RDR2 game service method allows adding any player to a new Posse without consentViolation of Secure Design Principles · medium
    10 votes
86. Referer Leakge in language changer may lead to FB token theft.Cross-Site Request Forgery (CSRF) · medium
    10 votes
87. Your support community suffers from angularjs injection and must be fixed immediately [CRITICAL]Code Injection · medium
    10 votes
88. Modifying Sprunk vs eCola crew dataInsecure Direct Object Reference (IDOR) · low
    9 votes
89. Image Injection on `/bully/anniversaryedition` may lead to FB's OAuth Token Theft.Information Disclosure · medium
    9 votes
90. dom based xss in https://www.rockstargames.com/GTAOnline/Cross-site Scripting (XSS) - Reflected · medium
    9 votes
91. Image Injection on /bully/anniversaryedition may lead to OAuth token theft.Information Disclosure · medium
    8 votes
92. flash injection in http://www.rockstargames.com/IV/imgPlayer/imageEmbed.swfResource Injection · medium
    8 votes
93. Profile bio at rockstar is accepting control charactersFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) · low
    8 votes
94. Image Injection vulnerability affecting www.rockstargames.com/careers may lead to Facebook OAuth TheftInformation Disclosure · medium
    7 votes
95. insecure redirect in https://www.rockstargames.comViolation of Secure Design Principles · low
    7 votes
96. Control characters incorrectly handled on Crew Status UpdateCode Injection · low
    $2507 votes
97. CSRF Vulnerabiliy on Facebook Linkage Page Allows Full Account takerover of Socialclub Accounts.Cross-Site Request Forgery (CSRF) · high
    6 votes
98. DOM based XSS on /GTAOnline/de/news/article via "returnUrl" parameterCross-site Scripting (XSS) - DOM · medium
    6 votes
99. image injection /screenshot-viewer/responsive/image (ANOTHER FIX BYPASS)Information Disclosure · medium
    6 votes
100. Image injection on /screenshot-viewer/responsive/image ( FIX BYPASS)Information Disclosure · medium
     6 votes