Browse / Shopify

Shopify

See its reports on the map

Attack surface: 27,668 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Shopify

• Cross-site Scripting128
• Access Control99
• Authentication70
• Information Disclosure48
• Misconfiguration25
• Open Redirect19

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Takeover an account that doesn't have a Shopify ID and morecritical
   3,006 votes
2. Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOPrivilege Escalation · critical
   1,922 votes
3. Github access token exposureImproper Authentication - Generic · critical
   $50,0001,601 votes
4. [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationPrivilege Escalation · critical
   894 votes
5. H1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsCommand Injection - Generic · medium
   830 votes
6. SSRF in Exchange leads to ROOT access in all instancesServer-Side Request Forgery (SSRF) · medium
   587 votes
7. Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationPrivilege Escalation · critical
   559 votes
8. Shopify Stocky App OAuth MisconfigurationPrivilege Escalation · medium
   527 votes
9. H1514 Server Side Template Injection in Return Magic email templates?Code Injection
   409 votes
10. H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsBusiness Logic Errors · medium
    372 votes
11. XSS while logging using GoogleCross-site Scripting (XSS) - Reflected
    $1,750341 votes
12. Stored XSS in my staff name fired in another your internal panelCross-site Scripting (XSS) - Stored · high
    326 votes
13. Shopify admin authentication bypass using partners.shopify.comImproper Authorization · critical
    311 votes
14. Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationImproper Access Control - Generic · medium
    310 votes
15. CSRF on connecting Paypal as Payment ProviderCross-Site Request Forgery (CSRF) · medium
    304 votes
16. Ability to bypass partner email confirmation to take over any store given an employee emailTime-of-check Time-of-use (TOCTOU) Race Condition · critical
    $15,250273 votes
17. DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.comCache Poisoning · medium
    $3,800266 votes
18. Shopify Partners Invitation Process Allows Privilege Escalation Without Email VerificationImproper Access Control - Generic · medium
    245 votes
19. XSS at jamfpro.shopifycloud.comCross-site Scripting (XSS) - Generic · medium
    $9,400240 votes
20. H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingCross-site Scripting (XSS) - DOM · high
    195 votes
21. H1514 [*.(my)shopify.com] - Viewing Password Protected ContentImproper Authentication - Generic · critical
    $3,000192 votes
22. IDOR on GraphQL queries BillingDocumentDownload and BillDetailsInsecure Direct Object Reference (IDOR) · medium
    $5,000187 votes
23. Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.comImproper Access Control - Generic · medium
    181 votes
24. XSS at https://exchangemarketplace.com/blogsearchCross-site Scripting (XSS) - Generic · medium
    174 votes
25. GraphQL AdminGenerateSessionPayload is leaked to staff with no permissionImproper Authentication - Generic · medium
    173 votes
26. [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)Incorrect Permission Assignment for Critical Resource · medium
    $3,100166 votes
27. XSS in www.shopify.com/markets?utm_source=Cross-site Scripting (XSS) - Reflected · low
    159 votes
28. Undocumented `fileCopy` GraphQL APIImproper Access Control - Generic · medium
    $2,000157 votes
29. Session works after logout from Shopify account and password of online store is displayedImproper Authentication - Generic · low
    157 votes
30. Stored XSS in SVG file as data: urlCross-site Scripting (XSS) - Stored · medium
    $5,300153 votes
31. Informations disclosure - Access to some checkout informationsInformation Disclosure · medium
    150 votes
32. User with removed manage shops permissions is still able to make changes to a shop Improper Access Control - Generic · medium
    145 votes
33. H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.comSession Fixation
    144 votes
34. HTTP Response Header Injection in shopify/pitchfork + Rack 3HTTP Response Splitting · low
    $800136 votes
35. [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users imageInformation Disclosure · medium
    $2,900135 votes
36. Create free Shopify application credits.Improper Access Control - Generic · medium
    134 votes
37. Reflected XSS In Marketing Reports Page On *.myshopify.com/adminCross-site Scripting (XSS) - Reflected · medium
    128 votes
38. Stored XSS in private messageCross-site Scripting (XSS) - Stored · medium
    $1,000124 votes
39. XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"Cross-site Scripting (XSS) - DOM
    $3,000121 votes
40. Disclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APP Privilege Escalation
    116 votes
41. Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email VerificationImproper Authentication - Generic · low
    $800112 votes
42. Reflected XSS on help.shopify.comCross-site Scripting (XSS) - Reflected · low
    $500111 votes
43. Access to Employee calendar disclosing internal presentation and meetingsImproper Access Control - Generic · low
    $1,000111 votes
44. Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image RenderingCross-site Scripting (XSS) - Reflected · medium
    $1,600110 votes
45. Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.phpImproper Access Control - Generic · medium
    $2,900109 votes
46. Stored XSS in Shopify Chat Cross-site Scripting (XSS) - Stored · low
    $500106 votes
47. Reflected XSS in *.myshopify.com/account/registerCross-site Scripting (XSS) - Reflected · medium
    104 votes
48. Bypass a fix for report #708013Improper Restriction of Authentication Attempts · medium
    $3,500102 votes
49. Exposed Cortex API at https://cortex-ingest.shopifycloud.com/Misconfiguration · medium
    $6,300101 votes
50. Reflected XSS online-store-git.shopifycloud.comCross-site Scripting (XSS) - Reflected · medium
    $3,50098 votes
51. Ability to publish a paid theme without purchasing it.Improper Access Control - Generic · low
    $2,00090 votes
52. Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile)Improper Authentication - Generic · low
    $50090 votes
53. Reverse Proxy misroute leading to steal X-Shopify-Access-Token headerServer-Side Request Forgery (SSRF) · medium
    $1,00090 votes
54. Add new development stores without permissionImproper Access Control - Generic · medium
    89 votes
55. URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify LinkpopCache Poisoning · low
    $50088 votes
56. XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applicationsCross-site Scripting (XSS) - Stored · high
    $5,00088 votes
57. No Session Expiry after log-out, attacker can reuse the old cookiesInsufficient Session Expiration · low
    $50087 votes
58. Ability to link a Google account to another staff account/store owner that isn't linked yet
    84 votes
59. https://themes.shopify.com::: Host header web cache poisoning lead to DoSUncontrolled Resource Consumption · medium
    $2,90082 votes
60. SVG Server Side Request Forgery (SSRF)Server-Side Request Forgery (SSRF) · low
    $50081 votes
61. Reflective Cross-site Scripting via Newsletter FormCross-site Scripting (XSS) - Reflected · high
    $2,00079 votes
62. Blog posts atom feed of a store with password protection can be accessed by anyone Information Disclosure · medium
    76 votes
63. Stored XSS in /admin/product and /admin/collectionsCross-site Scripting (XSS) - Stored · medium
    $5,30076 votes
64. ██████ DOM XSS via Shopify.API.remoteRedirectCross-site Scripting (XSS) - DOM · low
    76 votes
65. Ability to verify any email address you don't own - accounts.shopify.comViolation of Secure Design Principles
    76 votes
66. xss storedCross-site Scripting (XSS) - Stored
    75 votes
67. Stored XSS in Discounts sectionCross-site Scripting (XSS) - Generic · medium
    $1,00075 votes
68. Blind Stored XSS in shopify internal Parquet ViewerCross-site Scripting (XSS) - Stored · medium
    74 votes
69. CircleCI token in github repo allows for access to sensitive build informationInformation Disclosure
    74 votes
70. A staff member with no permissions can edit Store Customer EmailInsecure Direct Object Reference (IDOR) · medium
    $1,50072 votes
71. help.shopify.com Cross Site ScriptingCross-site Scripting (XSS) - Stored · low
    71 votes
72. myshopify.com domain takeoverBusiness Logic Errors · medium
    71 votes
73. Stealing livechat token and using it to chat as the user - user information disclosure Improper Authentication - Generic
    71 votes
74. xss is triggered on your webCross-site Scripting (XSS) - DOM · medium
    69 votes
75. POST-based XSS on apps.shopify.comCross-site Scripting (XSS) - Generic · low
    $50069 votes
76. Session works after logout from Shopify accountConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low
    69 votes
77. Reflected XSS in <any>.myshopify.com through theme previewCross-site Scripting (XSS) - Reflected
    69 votes
78. Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.comImproper Authentication - Generic
    $50068 votes
79. Stored XSS through Facebook Page ConnectionCross-site Scripting (XSS) - Stored · low
    68 votes
80. A non-privileged user may create an admin account in StockyPrivilege Escalation · medium
    67 votes
81. Cache poisoning via X-Forwarded-Host in www.shopify.com/partners/blogImproper Neutralization of HTTP Headers for Scripting Syntax · low
    $1,00067 votes
82. Staff without Manage Themes permissions can update themesImproper Access Control - Generic · medium
    66 votes
83. Shopify GitHub Login and Password exposed all private source code might be available.Information Disclosure
    $1,50066 votes
84. URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript ExecutionForced Browsing · low
    65 votes
85. Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)Client-Side Enforcement of Server-Side Security · low
    $90065 votes
86. Disclose customer orders details by shopify chat application.Information Disclosure · medium
    $2,50065 votes
87. Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/****Cross-site Scripting (XSS) - Stored · medium
    $2,90063 votes
88. Insufficient session expiration in the **com.shopify.ping** android appInsufficient Session Expiration · low
    63 votes
89. Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance.Information Disclosure · low
    $50062 votes
90. Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypassImproper Authentication - Generic · critical
    61 votes
91. Open redirect using theme installOpen Redirect
    61 votes
92. Non-store owners can transfer Shopify-managed domain to another domain providerImproper Access Control - Generic · medium
    58 votes
93. Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!Information Disclosure · medium
    $2,90058 votes
94. XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.comViolation of Secure Design Principles · low
    58 votes
95. Reflected XSS on $Any$.myshopify.com/adminCross-site Scripting (XSS) - Reflected · high
    $1,50058 votes
96. H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumptionInformation Disclosure
    $80257 votes
97. staff can able to extend shopify trial period without admin permissionImproper Access Control - Generic · low
    56 votes
98. SSRF in hatchful.shopify.comServer-Side Request Forgery (SSRF) · low
    $50056 votes
99. Self XSSCross-site Scripting (XSS) - Generic
    $50055 votes
100. Stored XSS on activityCross-site Scripting (XSS) - Stored · high
     $2,00055 votes