HexBrain
Sign in

Browse / Shopify

Shopify

467disclosed reports
$281,352paid in bounties

See its reports on the map

What gets reported to Shopify

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Takeover an account that doesn't have a Shopify ID and morecritical
    3,006 votes
  2. Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOPrivilege Escalation · critical
    1,922 votes
  3. Github access token exposureImproper Authentication - Generic · critical
    $50,0001,601 votes
  4. [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationPrivilege Escalation · critical
    894 votes
  5. H1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsCommand Injection - Generic · medium
    830 votes
  6. SSRF in Exchange leads to ROOT access in all instancesServer-Side Request Forgery (SSRF) · medium
    587 votes
  7. Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationPrivilege Escalation · critical
    559 votes
  8. Shopify Stocky App OAuth MisconfigurationPrivilege Escalation · medium
    527 votes
  9. H1514 Server Side Template Injection in Return Magic email templates?Code Injection
    409 votes
  10. H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsBusiness Logic Errors · medium
    372 votes
  11. XSS while logging using GoogleCross-site Scripting (XSS) - Reflected
    $1,750341 votes
  12. Stored XSS in my staff name fired in another your internal panelCross-site Scripting (XSS) - Stored · high
    326 votes
  13. Shopify admin authentication bypass using partners.shopify.comImproper Authorization · critical
    311 votes
  14. Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationImproper Access Control - Generic · medium
    310 votes
  15. CSRF on connecting Paypal as Payment ProviderCross-Site Request Forgery (CSRF) · medium
    304 votes
  16. Ability to bypass partner email confirmation to take over any store given an employee emailTime-of-check Time-of-use (TOCTOU) Race Condition · critical
    $15,250273 votes
  17. DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.comCache Poisoning · medium
    $3,800266 votes
  18. Shopify Partners Invitation Process Allows Privilege Escalation Without Email VerificationImproper Access Control - Generic · medium
    245 votes
  19. XSS at jamfpro.shopifycloud.comCross-site Scripting (XSS) - Generic · medium
    $9,400240 votes
  20. H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingCross-site Scripting (XSS) - DOM · high
    195 votes
  21. H1514 [*.(my)shopify.com] - Viewing Password Protected ContentImproper Authentication - Generic · critical
    $3,000192 votes
  22. IDOR on GraphQL queries BillingDocumentDownload and BillDetailsInsecure Direct Object Reference (IDOR) · medium
    $5,000187 votes
  23. Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.comImproper Access Control - Generic · medium
    181 votes
  24. XSS at https://exchangemarketplace.com/blogsearchCross-site Scripting (XSS) - Generic · medium
    174 votes
  25. GraphQL AdminGenerateSessionPayload is leaked to staff with no permissionImproper Authentication - Generic · medium
    173 votes
  26. [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)Incorrect Permission Assignment for Critical Resource · medium
    $3,100166 votes
  27. XSS in www.shopify.com/markets?utm_source=Cross-site Scripting (XSS) - Reflected · low
    159 votes
  28. Undocumented `fileCopy` GraphQL APIImproper Access Control - Generic · medium
    $2,000157 votes
  29. Session works after logout from Shopify account and password of online store is displayedImproper Authentication - Generic · low
    157 votes
  30. Stored XSS in SVG file as data: urlCross-site Scripting (XSS) - Stored · medium
    $5,300153 votes
  31. Informations disclosure - Access to some checkout informationsInformation Disclosure · medium
    150 votes
  32. User with removed manage shops permissions is still able to make changes to a shop Improper Access Control - Generic · medium
    145 votes
  33. H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.comSession Fixation
    144 votes
  34. HTTP Response Header Injection in shopify/pitchfork + Rack 3HTTP Response Splitting · low
    $800136 votes
  35. [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users imageInformation Disclosure · medium
    $2,900135 votes
  36. Create free Shopify application credits.Improper Access Control - Generic · medium
    134 votes
  37. Reflected XSS In Marketing Reports Page On *.myshopify.com/adminCross-site Scripting (XSS) - Reflected · medium
    128 votes
  38. Stored XSS in private messageCross-site Scripting (XSS) - Stored · medium
    $1,000124 votes
  39. XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"Cross-site Scripting (XSS) - DOM
    $3,000121 votes
  40. Disclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APP Privilege Escalation
    116 votes
  41. Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email VerificationImproper Authentication - Generic · low
    $800112 votes
  42. Reflected XSS on help.shopify.comCross-site Scripting (XSS) - Reflected · low
    $500111 votes
  43. Access to Employee calendar disclosing internal presentation and meetingsImproper Access Control - Generic · low
    $1,000111 votes
  44. Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image RenderingCross-site Scripting (XSS) - Reflected · medium
    $1,600110 votes
  45. Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.phpImproper Access Control - Generic · medium
    $2,900109 votes
  46. Stored XSS in Shopify Chat Cross-site Scripting (XSS) - Stored · low
    $500106 votes
  47. Reflected XSS in *.myshopify.com/account/registerCross-site Scripting (XSS) - Reflected · medium
    104 votes
  48. Bypass a fix for report #708013Improper Restriction of Authentication Attempts · medium
    $3,500102 votes
  49. Exposed Cortex API at https://cortex-ingest.shopifycloud.com/Misconfiguration · medium
    $6,300101 votes
  50. Reflected XSS online-store-git.shopifycloud.comCross-site Scripting (XSS) - Reflected · medium
    $3,50098 votes
  51. Ability to publish a paid theme without purchasing it.Improper Access Control - Generic · low
    $2,00090 votes
  52. Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile)Improper Authentication - Generic · low
    $50090 votes
  53. Reverse Proxy misroute leading to steal X-Shopify-Access-Token headerServer-Side Request Forgery (SSRF) · medium
    $1,00090 votes
  54. Add new development stores without permissionImproper Access Control - Generic · medium
    89 votes
  55. URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify LinkpopCache Poisoning · low
    $50088 votes
  56. XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applicationsCross-site Scripting (XSS) - Stored · high
    $5,00088 votes
  57. No Session Expiry after log-out, attacker can reuse the old cookiesInsufficient Session Expiration · low
    $50087 votes
  58. Ability to link a Google account to another staff account/store owner that isn't linked yet
    84 votes
  59. https://themes.shopify.com::: Host header web cache poisoning lead to DoSUncontrolled Resource Consumption · medium
    $2,90082 votes
  60. SVG Server Side Request Forgery (SSRF)Server-Side Request Forgery (SSRF) · low
    $50081 votes
  61. Reflective Cross-site Scripting via Newsletter FormCross-site Scripting (XSS) - Reflected · high
    $2,00079 votes
  62. admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removedInformative
    78 votes
  63. Exposure of shopify employee summit page allows anonymous user to place orders for free booksInformativeBusiness Logic Errors
    76 votes
  64. Blog posts atom feed of a store with password protection can be accessed by anyone Information Disclosure · medium
    76 votes
  65. Stored XSS in /admin/product and /admin/collectionsCross-site Scripting (XSS) - Stored · medium
    $5,30076 votes
  66. ██████ DOM XSS via Shopify.API.remoteRedirectCross-site Scripting (XSS) - DOM · low
    76 votes
  67. Ability to verify any email address you don't own - accounts.shopify.comViolation of Secure Design Principles
    76 votes
  68. xss storedCross-site Scripting (XSS) - Stored
    75 votes
  69. Stored XSS in Discounts sectionCross-site Scripting (XSS) - Generic · medium
    $1,00075 votes
  70. Blind Stored XSS in shopify internal Parquet ViewerCross-site Scripting (XSS) - Stored · medium
    74 votes
  71. CircleCI token in github repo allows for access to sensitive build informationInformation Disclosure
    74 votes
  72. A staff member with no permissions can edit Store Customer EmailInsecure Direct Object Reference (IDOR) · medium
    $1,50072 votes
  73. help.shopify.com Cross Site ScriptingCross-site Scripting (XSS) - Stored · low
    71 votes
  74. myshopify.com domain takeoverBusiness Logic Errors · medium
    71 votes
  75. Stealing livechat token and using it to chat as the user - user information disclosure Improper Authentication - Generic
    71 votes
  76. xss is triggered on your webCross-site Scripting (XSS) - DOM · medium
    69 votes
  77. POST-based XSS on apps.shopify.comCross-site Scripting (XSS) - Generic · low
    $50069 votes
  78. Session works after logout from Shopify accountConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low
    69 votes
  79. Reflected XSS in <any>.myshopify.com through theme previewCross-site Scripting (XSS) - Reflected
    69 votes
  80. Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.comImproper Authentication - Generic
    $50068 votes
  81. Stored XSS through Facebook Page ConnectionCross-site Scripting (XSS) - Stored · low
    68 votes
  82. A non-privileged user may create an admin account in StockyPrivilege Escalation · medium
    67 votes
  83. Cache poisoning via X-Forwarded-Host in www.shopify.com/partners/blogImproper Neutralization of HTTP Headers for Scripting Syntax · low
    $1,00067 votes
  84. Staff without Manage Themes permissions can update themesImproper Access Control - Generic · medium
    66 votes
  85. Shopify GitHub Login and Password exposed all private source code might be available.Information Disclosure
    $1,50066 votes
  86. URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript ExecutionForced Browsing · low
    65 votes
  87. Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)Client-Side Enforcement of Server-Side Security · low
    $90065 votes
  88. Disclose customer orders details by shopify chat application.Information Disclosure · medium
    $2,50065 votes
  89. Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)InformativeSession Fixation
    63 votes
  90. Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/****Cross-site Scripting (XSS) - Stored · medium
    $2,90063 votes
  91. Insufficient session expiration in the **com.shopify.ping** android appInsufficient Session Expiration · low
    63 votes
  92. Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance.Information Disclosure · low
    $50062 votes
  93. Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypassImproper Authentication - Generic · critical
    61 votes
  94. Open redirect using theme installOpen Redirect
    61 votes
  95. Non-store owners can transfer Shopify-managed domain to another domain providerImproper Access Control - Generic · medium
    58 votes
  96. Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!Information Disclosure · medium
    $2,90058 votes
  97. XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.comViolation of Secure Design Principles · low
    58 votes
  98. Reflected XSS on $Any$.myshopify.com/adminCross-site Scripting (XSS) - Reflected · high
    $1,50058 votes
  99. H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumptionInformation Disclosure
    $80257 votes
  100. staff can able to extend shopify trial period without admin permissionImproper Access Control - Generic · low
    56 votes