Browse / Starbucks

Starbucks

See its reports on the map

Attack surface: 5,438 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Starbucks

• Cross-site Scripting27
• Access Control18
• Authentication15
• Information Disclosure13
• Cross-Site Request Forgery11
• Insecure Direct Object Reference8

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseSQL Injection · critical
   801 votes
2. JumpCloud API Key leaked via Open Github Repository.Use of Hard-coded Credentials · critical
   739 votes
3. Webshell via File Upload on ecjobs.starbucks.com.cnOS Command Injection · critical
   688 votes
4. RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Code Injection · critical
   572 votes
5. XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspxXML External Entities (XXE) · critical
   319 votes
6. Subdomain takeover of datacafe-cert.starbucks.comPrivilege Escalation · high
   311 votes
7. Singapore - Account Takeover via IDORInsecure Direct Object Reference (IDOR) · critical
   260 votes
8. Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgImproper Access Control - Generic · critical
   247 votes
9. Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataPath Traversal · critical
   239 votes
10. Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceSQL Injection · critical
    236 votes
11. Blind SQL Injection on starbucks.com.gt and WAF Bypass :*SQL Injection · high
    210 votes
12. sdrc.starbucks.com - Information Disclosure via unsecured attachment directoryInformation Disclosure · critical
    197 votes
13. Reflected Cross site Scripting (XSS) on www.starbucks.comCross-site Scripting (XSS) - Reflected · medium
    181 votes
14. Bug in GraphQL and API integration leads to limited user address disclosureImproper Access Control - Generic · high
    144 votes
15. Subdomain takeover of d02-1-ag.productioncontroller.starbucks.comPrivilege Escalation · high
    122 votes
16. Subdomain takeover of mydailydev.starbucks.comExternally Controlled Reference to a Resource in Another Sphere · high
    122 votes
17. China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API EndpointInformation Disclosure · critical
    116 votes
18. Subdomain takeover on svcgatewayus.starbucks.comPrivilege Escalation · critical
    109 votes
19. Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS recordPrivilege Escalation · high
    105 votes
20. Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication.Improper Access Control - Generic · medium
    99 votes
21. Subdomain takeover on wfmnarptpc.starbucks.comPrivilege Escalation · high
    91 votes
22. Multiple Subdomain takeovers via unclaimed instancesPrivilege Escalation · high
    83 votes
23. Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/Path Traversal · critical
    81 votes
24. Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pagesCross-site Scripting (XSS) - Generic · high
    78 votes
25. Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using ChromeCross-Site Request Forgery (CSRF) · high
    77 votes
26. Leaking sensitive files on Github leads to internal files (python scripts,SQL files)Information Disclosure · critical
    73 votes
27. Reflected cross-site scripting on multiple Starbucks assets.Cross-site Scripting (XSS) - Reflected · low
    72 votes
28. Reflected XSS in https://www.starbucks.co.jp/store/search/Cross-site Scripting (XSS) - Reflected · medium
    72 votes
29. China - president-starbucks.com.cn DNS configuration reported as takeoverPrivilege Escalation · high
    71 votes
30. Parameter Manipulation allowed for viewing of other user’s teavana.com ordersImproper Authentication - Generic
    71 votes
31. [mena.starbucks.com] Laravel App Log & Configuration Disclosure.Information Disclosure · high
    63 votes
32. Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/uploadCross-site Scripting (XSS) - Stored · medium
    61 votes
33. WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass)Cross-site Scripting (XSS) - Reflected · low
    58 votes
34. Information disclosure on sim.starbucks.comInformation Disclosure · low
    58 votes
35. Store Development Resource Center was vulnerable to a Remote Code Execution - Unauthenticated Remote Command Injection (CVE-2019-0604)OS Command Injection · critical
    57 votes
36. Open Redirection in Login - Korean StarbucksOpen Redirect · low
    54 votes
37. Subdomain takeover on developer.openapi.starbucks.comImproper Access Control - Generic · high
    51 votes
38. Unauthorized access to jiratest.starbucks.com Improper Authentication - Generic · critical
    49 votes
39. Information Leak - Github - JMS InformationInformation Disclosure · high
    48 votes
40. Java Deserialization RCE via JBoss on card.starbucks.inCode Injection · critical
    48 votes
41. China - ecjobsdc.starbucks.com.cn html/shtml file upload vulnerabilityPrivilege Escalation · high
    46 votes
42. China - IDOR on Reservation Staging/Non Production Site - https://reservation.stg.starbucks.com.cnInsecure Direct Object Reference (IDOR) · medium
    45 votes
43. Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parametersCross-site Scripting (XSS) - Reflected · medium
    43 votes
44. Java Deserialization RCE via JBoss JMXInvokerServlet/EJBInvokerServlet on card.starbucks.inCode Injection
    42 votes
45. Able to purchase a gift card with any amountInsecure Direct Object Reference (IDOR) · high
    41 votes
46. svcardproxydevus.starbucks.com Subdomain take overImproper Access Control - Generic · high
    39 votes
47. PHPinfo pageInformation Disclosure · low
    39 votes
48. Stored XSS on www.starbucks.com.sg/careers/career-center/career-landing-*Cross-site Scripting (XSS) - Stored · medium
    37 votes
49. Parameter Manipulation allowed for editing the shipping address for other user’s teavana.com subscriptions.Improper Authentication - Generic
    37 votes
50. Thailand - Insecure Direct Object Reference permits an unauthorized user to transfer funds from a victim using only the victims Starbucks cardInsecure Direct Object Reference (IDOR) · high
    36 votes
51. www.starbucks.co.uk Reflected XSS via utm_source parameterCross-site Scripting (XSS) - Generic
    36 votes
52. Subdomain takeover on svcgatewaydevus.starbucks.com and svcgatewayloadus.starbucks.comPrivilege Escalation · critical
    35 votes
53. Time-based Blind SQLi on news.starbucks.comSQL Injection · high
    35 votes
54. Persistent XSS in www.starbucks.comCross-site Scripting (XSS) - Generic · high
    35 votes
55. CRLF injection on www.starbucks.comCRLF Injection · medium
    34 votes
56. SSRF at ideas.starbucks.comServer-Side Request Forgery (SSRF) · high
    33 votes
57. Starbucks China Android app cloud storage service leaks a credential.Information Disclosure · high
    33 votes
58. Singapore - XXE at https://www.starbucks.com.sg/RestApi/soap11XML External Entities (XXE) · high
    32 votes
59. athome.starbucks.com - URL parameter tampering of review forms permitted possible content injectionImproper Input Validation · medium
    31 votes
60. Account take over of 'light' starbuckscardb2b usersImproper Authentication - Generic · high
    30 votes
61. Possible SOP bypass in www.starbucks.com due to insecure crossdomain.xmlCross-Site Request Forgery (CSRF) · high
    29 votes
62. SAP Server - default credentials enabledImproper Authentication - Generic · medium
    29 votes
63. Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card numberInsecure Direct Object Reference (IDOR) · low
    28 votes
64. Full Api Access and Run All Functions via Starbucks AppImproper Authentication - Generic · medium
    28 votes
65. Norway - store.starbucks.no - CSRF on email changeCross-Site Request Forgery (CSRF) · high
    27 votes
66. DOM XSS on app.starbucks.com via ReturnUrlCross-site Scripting (XSS) - DOM · medium
    27 votes
67. SQL injection in partner id field on https://www.teavana.com (Sign-up form)SQL Injection · medium
    27 votes
68. XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod)Cross-site Scripting (XSS) - Generic · high
    27 votes
69. [stagecafrstore.starbucks.com] CRLF Injection, XSSCross-site Scripting (XSS) - Generic · low
    27 votes
70. Reflected XSS by exploiting CSRF vulnerability on teavana.com wishlist comment module. (wishlist-comments)Cross-site Scripting (XSS) - Generic · medium
    27 votes
71. Bulgaria - Subdomain takeover of mail.starbucks.bgPrivilege Escalation · high
    26 votes
72. Possible subdomain takeover at openapi.starbucks.comMisconfiguration · high
    24 votes
73. Improper handling of payment callback allows topping up a Swiss Starbucks Card bypassing actual payment via a crafted success messageBusiness Logic Errors · high
    23 votes
74. Thailand – a small number of alarm system portals accessible with the default credentialsImproper Authentication - Generic · high
    23 votes
75. [newscdn.starbucks.com] CRLF Injection, XSSHTTP Response Splitting · medium
    23 votes
76. unuse domain still in using at wechat by Starbucks East ChinaImproper Access Control - Generic · critical
    22 votes
77. Unauthorized access to a system used for CI/CD processesImproper Authentication - Generic · high
    22 votes
78. Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sitesCross-Site Request Forgery (CSRF) · high
    22 votes
79. DVR default username and passwordImproper Authentication - Generic · medium
    21 votes
80. Singapore - IDOR in campaign.starbucks.com.sgInsecure Direct Object Reference (IDOR) · medium
    20 votes
81. India - OTP bypass on Phone number verification for account creationImproper Authentication - Generic · medium
    20 votes
82. Default credentials for the temporary POC site alipoc.stg.starbucks.com.cn permitted WAF bypass and RCEOS Command Injection · medium
    19 votes
83. Host header injection/redirection via newsletter signupOpen Redirect · low
    19 votes
84. Stored XSS in comments on https://www.starbucks.co.uk/blog/*Cross-site Scripting (XSS) - Stored · high
    19 votes
85. Open redirect / Reflected XSS payload in root that affects all your sites (store.starbucks.* / shop.starbucks.* / teavana.com)Cross-site Scripting (XSS) - Generic · medium
    19 votes
86. Able to reset other user's password in https://card.starbucks.com.sg/Improper Authentication - Generic · medium
    18 votes
87. Lack of Controls Allowing for Card and PIN Enumeration Leading to FraudInformation Disclosure · high
    18 votes
88. DOM-based XSS in store.starbucks.co.uk on IE 11Cross-site Scripting (XSS) - DOM · low
    17 votes
89. Korea - LFI Server directory traversal at starbucks.co.krPath Traversal · high
    16 votes
90. Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busyImproper Access Control - Generic · medium
    16 votes
91. Exposed Unencrypted Telnet EndpointInformation Disclosure · low
    16 votes
92. Minimal information disclosure of internal asset names and links which were not publicly accessible.Information Disclosure · low
    15 votes
93. Backup Source Code Detectedmedium
    15 votes
94. DOM XSS on teavana.com via "pr_zip_location" parameterCross-site Scripting (XSS) - Generic · medium
    15 votes
95. Reflected XSS on teavana.com (Locale-Change)Cross-site Scripting (XSS) - Generic · medium
    15 votes
96. Dom Based Xss DIV.innerHTML parameters store.starbucks*Cross-site Scripting (XSS) - Generic · low
    15 votes
97. India - An Insecure Direct Object Reference (IDOR) allowed unauthorized access to view card index number and monetary balanceInsecure Direct Object Reference (IDOR) · medium
    14 votes
98. Reflected DOM XSS on www.starbucks.co.ukCross-site Scripting (XSS) - Reflected · medium
    14 votes
99. Reflected XSS on https://www.starbucks.co.uk/shop/paymentmethod/ (bypass for 227486)Cross-site Scripting (XSS) - Reflected · medium
    14 votes
100. out of date disqus shortname usage in the web app source codeViolation of Secure Design Principles · critical
     14 votes