Browse / Uber

Uber

See its reports on the map

Attack surface: 11,394 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Uber

• Cross-site Scripting52
• Information Disclosure50
• Authentication42
• Misconfiguration19
• Code Execution11
• Access Control11

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Multiple Vulnerabilities (Including SQLi) in love.uber.comDuplicateSQL Injection
   18 votes
2. Bruteforce INVITE codes easy wayDuplicateViolation of Secure Design Principles
   10 votes
3. The Microsoft Store Uber App Does Not Implement Certificate PinningDuplicateImproper Certificate Validation · critical
   7 votes
4. muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical
   5 votes
5. Use Partner/Driver App Without Being ActivatedDuplicateImproper Authentication - Generic
   5 votes
6. Self-XSS Vulnerability on Password Reset FormDuplicateCross-site Scripting (XSS) - Generic
   5 votes
7. XSS in people.uber.comDuplicateCross-site Scripting (XSS) - Generic
   4 votes
8. udi-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical
   3 votes
9. lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical
   3 votes
10. SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical
    3 votes
11. SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical
    3 votes
12. SSL-protected Reflected XSS in m.uber.comDuplicateCross-site Scripting (XSS) - Reflected · critical
    3 votes
13. Uber password reset link EMAIL FLOODDuplicateUncontrolled Resource Consumption
    3 votes
14. CRLF Injection in developer.uber.comDuplicateCRLF Injection
    3 votes
15. Unauthorized file (invoice) downloadDuplicateImproper Authentication - Generic
    3 votes
16. User credentials are not strong on vault.uber.comDuplicateImproper Authentication - Generic
    2 votes
17. Enumerating userIDs with phone numbersDuplicateInformation Disclosure
    2 votes
18. Session retention is present which reveals the customer infoDuplicateImproper Authentication - Generic
    2 votes
19. Self-XSS in Partners ProfileDuplicateCross-site Scripting (XSS) - Generic
    1 votes
20. CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```DuplicateUncontrolled Resource Consumption
    1 votes
21. SMS Flood with Update Profile DuplicateUncontrolled Resource Consumption
    1 votes
22. XSS on love.uber.comDuplicateCross-site Scripting (XSS) - Generic
    1 votes