Browse / Uber

Uber

See its reports on the map

Attack surface: 11,394 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Uber

• Cross-site Scripting52
• Information Disclosure50
• Authentication42
• Misconfiguration19
• Code Execution11
• Access Control11

Most upvoted reports

AllValidInformativeN/ADuplicate

1. XSS At "pages.et.uber.com"N/ACross-site Scripting (XSS) - Generic
   267 votes
2. Attacker could setup reminder remotely using brute forceN/ACross-Site Request Forgery (CSRF)
   36 votes
3. Session not expired When logout [partners.uber.com]N/AImproper Authentication - Generic
   12 votes
4. Content injection on 404 error page at faspex.uber.comN/AViolation of Secure Design Principles
   5 votes
5. reopen #128853 (Information disclosure at lite.uber.com)N/AInformation Disclosure
   5 votes
6. Uber is Flooding my Mobile with SMS Daily like a cron JOBN/AViolation of Secure Design Principles
   4 votes
7. Privilege escalation to allow non activated users to login and use uber partner ios appN/APrivilege Escalation
   1 votes