HexBrain
Sign in

Browse / TikTok

TikTok

117disclosed reports
$57,731paid in bounties

See its reports on the map

What gets reported to TikTok

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationCross-site Scripting (XSS) - Reflected · high
    473 votes
  2. Multiple bugs leads to RCE on TikTok for AndroidImproper Export of Android Application Components · critical
    371 votes
  3. [CSRF] TikTok Careers Portal Account TakeoverCross-Site Request Forgery (CSRF) · high
    366 votes
  4. Reflected XSS in TikTok endpointsCross-site Scripting (XSS) - Reflected · medium
    356 votes
  5. RCE on TikTok Ads PortalCode Injection · critical
    312 votes
  6. Stored-XSS-ads.tiktok.comCross-site Scripting (XSS) - Stored · low
    310 votes
  7. Incorrect authorization to the intelbot service leading to ticket informationImproper Authentication - Generic · critical
    $15,000219 votes
  8. IDOR delete any Tickets on ads.tiktok.comInsecure Direct Object Reference (IDOR) · high
    216 votes
  9. Stored XSS on TikTok AdsCross-site Scripting (XSS) - DOM · medium
    201 votes
  10. Blocked user can see live videoPrivacy Violation · medium
    $418198 votes
  11. Reflected XSS on Pangle Endpoint Cross-site Scripting (XSS) - Reflected · high
    $5,000196 votes
  12. TikTok 2FA BypassImproper Authorization · medium
    $1,564194 votes
  13. Account Takeover via Authentication Bypass in TikTok Account RecoveryAuthentication Bypass Using an Alternate Path or Channel · critical
    $12,000172 votes
  14. Unauthorized Access to TikTok Account [Private Videos] via API EndpointInsecure Direct Object Reference (IDOR) · medium
    167 votes
  15. External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processingServer-Side Request Forgery (SSRF) · high
    $2,727162 votes
  16. HTML Injection on TikTok AdsImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low
    159 votes
  17. DOM XSS in tiktok.com/login via the redirect_url parameterCross-site Scripting (XSS) - DOM · high
    140 votes
  18. IDOR on ads.tiktok.com Allows Unauthorized Product AdditionInsecure Direct Object Reference (IDOR) · low
    $500131 votes
  19. Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended ProductsBusiness Logic Errors · medium
    $1,000129 votes
  20. Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/Cross-site Scripting (XSS) - Reflected · high
    123 votes
  21. IDOR for changing privacy settings on any memoriesInsecure Direct Object Reference (IDOR) · high
    123 votes
  22. Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/uploadUnrestricted Upload of File with Dangerous Type · medium
    118 votes
  23. Reflected xss on ads.tiktok.com using `from` parameter.Cross-site Scripting (XSS) - Reflected · high
    112 votes
  24. IDOR on TikTok Ads EndpointInsecure Direct Object Reference (IDOR) · medium
    109 votes
  25. Multiple IDORs in family pairing apiInsecure Direct Object Reference (IDOR) · high
    107 votes
  26. DOM XSS on ads.tiktok.comCross-site Scripting (XSS) - DOM · medium
    $2,500104 votes
  27. Lack of rate limitation on careers site allows the attacker to brute force the verification codeImproper Restriction of Authentication Attempts · high
    104 votes
  28. Lynxview JS interfaces Takeover via deeplink traversalCross-site Scripting (XSS) - DOM · high
    103 votes
  29. Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).Cross-site Scripting (XSS) - Stored · medium
    102 votes
  30. Chain Vulnerability lead to Full Control Group Live Accounts & Undeletable CreatorPrivilege Escalation · medium
    98 votes
  31. CRLF injection leads to internal XSS on PangleGlobalCRLF Injection · medium
    97 votes
  32. CRLF to XSS & Open RedirectionCross-site Scripting (XSS) - Reflected · high
    97 votes
  33. HTML Injection on tiktoktutorials via firstName parameterImproper Input Validation · low
    97 votes
  34. Stored XSS on TikTok Live FormCross-site Scripting (XSS) - Stored · medium
    95 votes
  35. CSRF Account TakeoverCross-Site Request Forgery (CSRF) · high
    95 votes
  36. Multiple vulnerability leading to account takeover in TikTok SMB subdomain.Business Logic Errors · critical
    91 votes
  37. Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard ActivitiesPrivilege Escalation · medium
    89 votes
  38. Reflected XSS on TikTok WebsiteCross-site Scripting (XSS) - Reflected · medium
    $3,00089 votes
  39. Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is KnownInformation Disclosure · medium
    87 votes
  40. Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone VerificationImproper Access Control - Generic · low
    84 votes
  41. Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platformInsecure Direct Object Reference (IDOR) · high
    84 votes
  42. Unauthorized Access to Private Video Description via Translation API for Private AccountsInsecure Direct Object Reference (IDOR) · low
    82 votes
  43. 1 Click to 'Close Account and Refund' via POSTMESSAGEImproper Access Control - Generic · medium
    81 votes
  44. CSRF in ticket functionCross-Site Request Forgery (CSRF) · medium
    80 votes
  45. TikTok's pixel/sdk.js leaks current URL from websites using postMessageImproper Authorization · medium
    79 votes
  46. CSRF protection bypass on TikTok Webcast EndpointsCross-Site Request Forgery (CSRF) · medium
    $2,50079 votes
  47. Reflected XSS On [https://www-useast1a.tiktok.com/ug/incentive/share/hd]Cross-site Scripting (XSS) - Reflected · medium
    78 votes
  48. XSS Payload on TikTok Seller Center endpointCross-site Scripting (XSS) - Stored · medium
    77 votes
  49. Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text fieldCross-site Scripting (XSS) - Stored · medium
    75 votes
  50. IDOR the ability to view support tickets of any user on seller platformInsecure Direct Object Reference (IDOR) · medium
    $2,50074 votes
  51. BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOSImproper Access Control - Generic · medium
    $50072 votes
  52. XSS on tiktok.comCross-site Scripting (XSS) - Reflected · medium
    72 votes
  53. CORS misconfiguration in TikTok ads portal Improper Access Control - Generic · low
    69 votes
  54. Cross site scripting via file upload in subdomain ads.tiktok.comCross-site Scripting (XSS) - Stored · low
    $50065 votes
  55. Cross Site Scripting using Email parameter in Ads endpoint 1Cross-site Scripting (XSS) - Reflected · medium
    65 votes
  56. Bypass SMS verification to delete TikTok accountImproper Authorization · low
    64 votes
  57. IDOR on Tagged PeopleInsecure Direct Object Reference (IDOR) · medium
    63 votes
  58. Privilege Escalation on TikTok for BusinessInsecure Direct Object Reference (IDOR) · medium
    62 votes
  59. RXSS on TikTok endpointsCross-site Scripting (XSS) - Reflected · medium
    61 votes
  60. Multiple Open Redirect on TikTok domainsImproper Access Control - Generic · low
    61 votes
  61. XSS at TikTok Ads EndpointCross-site Scripting (XSS) - Reflected · high
    60 votes
  62. One Click Account Hijacking via Unvalidated DeeplinkForced Browsing · high
    60 votes
  63. Blocked user can send notification by liking the message due to Logical BugPrivacy Violation · low
    59 votes
  64. Broken Link on TikTokUS.InfoViolation of Secure Design Principles · low
    57 votes
  65. bypass two-factor authentication in Android apps and webAuthentication Bypass Using an Alternate Path or Channel · medium
    55 votes
  66. HTML Injection via Email ShareImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low
    53 votes
  67. Business Suite "Get Leads" Resulting in Revealing User Email & PhoneInsecure Direct Object Reference (IDOR) · high
    52 votes
  68. RXSS via region parameterCross-site Scripting (XSS) - Reflected · medium
    47 votes
  69. Ability to change permissions across seller platformImproper Access Control - Generic · medium
    47 votes
  70. Stored XSS in the ticketing systemCross-site Scripting (XSS) - Stored · medium
    $1,00046 votes
  71. Stored XSS Payload when sending videos Cross-site Scripting (XSS) - Stored · low
    44 votes
  72. IDOR in family pairing APIInsecure Direct Object Reference (IDOR) · low
    43 votes
  73. XSS and iframe injection on tiktok ads portal using redirect paramsCross-site Scripting (XSS) - Reflected · medium
    43 votes
  74. Bypass "Industry Documents" ValidationImproper Access Control - Generic · low
    $5043 votes
  75. CSRF in seller-us.tiktok.com/profile/account-setting/delegation-login Cross-Site Request Forgery (CSRF) · medium
    41 votes
  76. View thumbnail of any private video (friends or followers only) of Private/Public account Privacy Violation · low
    $50041 votes
  77. CSRF To Add New App In Developer Account And Bypassing Json FormatCross-Site Request Forgery (CSRF) · medium
    $20039 votes
  78. Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.comCross-site Scripting (XSS) - Stored · low
    $25038 votes
  79. HTML Injection on Company Name on EmailImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low
    $7938 votes
  80. Lack of session expiration after password reset on TikTok Careers PortalInsufficient Session Expiration · low
    $5038 votes
  81. CSRF in Changing User Verification EmailCross-Site Request Forgery (CSRF) · low
    $50037 votes
  82. Open Redirect Vulnerability on TikTok Ads Portal Open Redirect · medium
    37 votes
  83. HTML Injection through Account Name field on TikTok ads portal being rendered on emailsCode Injection · low
    36 votes
  84. Add products to any livestream.Insecure Direct Object Reference (IDOR) · medium
    34 votes
  85. IDOR on TikTok SellerInsecure Direct Object Reference (IDOR) · low
    31 votes
  86. Open Redirect TO Stealing aadvidOpen Redirect · low
    31 votes
  87. Bypassing authorization of linked Instagram accountMissing Authorization · low
    $17030 votes
  88. TikTok Session Donation CSRF via QR code loginCross-Site Request Forgery (CSRF) · low
    30 votes
  89. HTML Injection via TikTok Ads Email Share Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
    29 votes
  90. Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)Privilege Escalation · low
    $20029 votes
  91. Remotely Accessible Container Advisor exposed performance metrics and resource usageInformation Disclosure · low
    $10028 votes
  92. TikTok Account Creation Date Information Disclosure Privacy Violation · low
    $10028 votes
  93. Any user can vote on `Friend Only` video pullImproper Authorization · low
    27 votes
  94. Internal Employee informations Disclosure via TikTok Athena apiInformation Disclosure · medium
    $1,00027 votes
  95. Clickjacking Vulnerability Can Leads To Delete Developer APPUI Redressing (Clickjacking) · low
    $50027 votes
  96. IDOR in report download functionality on ads.tiktok.comInsecure Direct Object Reference (IDOR) · low
    $50025 votes
  97. Cross Site Scripting using Email parameter in Ads endpoint 2Cross-site Scripting (XSS) - Reflected · medium
    25 votes
  98. CSRF on TikTok Ads PortalCross-Site Request Forgery (CSRF) · medium
    $1,00023 votes
  99. Blind SSRF in ads.tiktok.comServer-Side Request Forgery (SSRF) · low
    23 votes
  100. User In The Same Center Can Create CSRF To Change The Information About BusinessCross-Site Request Forgery (CSRF) · low
    $14723 votes