Browse / Smule

Smule

See its reports on the map

Attack surface: 262 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-14.

What gets reported to Smule

• Authentication4
• Misconfiguration2
• Access Control1
• Server-Side Request Forgery1
• Open Redirect1
• Information Disclosure1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Error Page Content Spoofing or Text Injection Violation of Secure Design Principles · low
   74 votes
2. No Rate Limiting On Phone Number Login Leads to Login BypassImproper Authentication - Generic · medium
   51 votes
3. Possible Subdomain Takeover For Inbound EmailsImproper Access Control - Generic
   48 votes
4. Web cache poisoning leads to disclosure of CSRF token and sensitive informationViolation of Secure Design Principles · medium
   39 votes
5. Missing Rate Limit in Forgot Password can Lead to email address leakage of all smule accountsImproper Restriction of Authentication Attempts · medium
   32 votes
6. Open redirect bypass & SSRF Security VulnerabilityServer-Side Request Forgery (SSRF)
   31 votes
7. Missing Rate Limit in Password ChangeImproper Restriction of Authentication Attempts · low
   19 votes
8. Open Redirect on ███Open Redirect · medium
   19 votes
9. Disclosure of information about the system, configuration files.Information Disclosure · low
   16 votes
10. stored xss in https://www.smule.comCross-site Scripting (XSS) - Stored · high
    13 votes
11. [com.smule.autorap.*] Cloud Messaging/Push Notification service takeover due to clear-text usage of Legacy FCM Server keys in the client app Use of Hard-coded Credentials · critical
    10 votes