Browse / Uber

Uber

See its reports on the map

Attack surface: 11,394 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Uber

• Cross-site Scripting52
• Information Disclosure50
• Authentication42
• Misconfiguration19
• Code Execution11
• Access Control11

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterInformation Disclosure · high
   643 votes
2. [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoInsecure Storage of Sensitive Information · critical
   $40,000458 votes
3. Chained Bugs to Leak Victim's Uber's FB Oauth TokenImproper Authentication - Generic · high
   427 votes
4. Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgCleartext Transmission of Sensitive Information · high
   $4,000376 votes
5. RCE via npm misconfig -- installing internal libraries from the public registryCode Injection · critical
   $9,000325 votes
6. Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Improper Authentication - Generic
   312 votes
7. Stored XSS in developer.uber.comCross-site Scripting (XSS) - Generic
   $7,500223 votes
8. Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Improper Access Control - Generic · low
   $4,500210 votes
9. Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comImproper Authentication - Generic · critical
   183 votes
10. Open Redirect on central.uber.com allows for account takeoverImproper Authentication - Generic · high
    144 votes
11. Reading Emails in Uber SubdomainsImproper Authentication - Generic
    141 votes
12. uber.com may RCE by Flask Jinja2 Template InjectionCode Injection
    $10,000137 votes
13. [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameterCross-site Scripting (XSS) - Stored · high
    $3,000131 votes
14. Client secret, server tokens for developer applications returned by internal APIInformation Disclosure
    125 votes
15. IDOR leads to leak analytics of any restaurantInsecure Direct Object Reference (IDOR) · medium
    123 votes
16. Reflected XSS on https://www.uber.com Cross-site Scripting (XSS) - Reflected · high
    114 votes
17. IDOR leads to See analytics of Loyalty Program in any restaurant.Insecure Direct Object Reference (IDOR) · medium
    112 votes
18. ubernycmarketplace.com is vulnerable to the Heartbleed BugInformation Disclosure · low
    $1,500112 votes
19. Stored XSS on any page in most Uber domainsCross-site Scripting (XSS) - Stored · high
    $6,000107 votes
20. password reset token leaking allowed for ATO of an Uber accountImproper Authentication - Generic · critical
    $10,000100 votes
21. SQL Injection on sctrack.email.uber.com.cnSQL Injection
    $4,00093 votes
22. private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") eventsInformation Disclosure · medium
    91 votes
23. Complete Admin account takeover due to PhpDebugBar turned on in Uber's production serverMisconfiguration · medium
    90 votes
24. [CRITICAL] -- Complete Account TakeoverImproper Authentication - Generic
    $8,00089 votes
25. SAML Authentication Bypass on uchat.uberinternal.comImproper Authentication - Generic · high
    $8,50088 votes
26. OneLogin authentication bypass on WordPress sites via XMLRPCCode Injection
    $7,00083 votes
27. Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balanceBusiness Logic Errors · medium
    82 votes
28. Possibility to get private email using UUIDInformation Disclosure
    82 votes
29. Pre-auth Remote Code Execution on multiple Uber SSL VPN serversCommand Injection - Generic · critical
    $2,00080 votes
30. Subdomain takeover at signup.uber.comPrivilege Escalation · high
    79 votes
31. Changing paymentProfileUuid when booking a trip allows free ridesCross-Site Request Forgery (CSRF)
    73 votes
32. Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and filesInformation Disclosure · low
    $50070 votes
33. Subdomain takeover on rider.uber.com due to non-existent distribution on CloudfrontPrivilege Escalation
    69 votes
34. Lack of payment type validation in dial.uber.com allows for free ridesBusiness Logic Errors · high
    68 votes
35. Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PIIInsecure Direct Object Reference (IDOR) · high
    64 votes
36. xss in https://www.uber.comCross-site Scripting (XSS) - Generic
    64 votes
37. Authorization issue in Google G Suite allows DoS through HTTP redirectUncontrolled Resource Consumption · high
    62 votes
38. Hack The World 2017 Top 2 Bonus
    $5,00061 votes
39. SQL injection in 3rd party software AnomaliSQL Injection · high
    $2,50061 votes
40. Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment accountInsecure Direct Object Reference (IDOR) · high
    $5,75058 votes
41. Unrestricted File Upload Results in Cross-Site Scripting AttacksCross-site Scripting (XSS) - Stored · medium
    58 votes
42. OneLogin authentication bypass on WordPress sitesImproper Authentication - Generic
    $10,00058 votes
43. Blind OOB XXE At "http://ubermovement.com/"Command Injection - Generic
    $50056 votes
44. Multiple vulnerabilities in a WordPress plugin at drive.uber.comSQL Injection
    55 votes
45. [manage.jumpbikes.com] Blind XSS on Jump admin panel via user nameCross-site Scripting (XSS) - Stored · critical
    54 votes
46. Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account TakeoverCross-site Scripting (XSS) - Stored · medium
    $3,00052 votes
47. Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domainsCross-site Scripting (XSS) - Stored · high
    $6,00051 votes
48. [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.Cross-Site Request Forgery (CSRF) · critical
    $2,00050 votes
49. Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUserInformation Disclosure · critical
    49 votes
50. Avoiding Surge PricingViolation of Secure Design Principles
    45 votes
51. Change the rating of any trip, therefore change the average driver ratingBusiness Logic Errors · medium
    $1,50043 votes
52. Publicly exposed HashiCorp Vault (Secrets management) at usec-gcp-staging.uberinternal.com & usec-gcp.uberinternal.comInformation Disclosure
    43 votes
53. SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partnersSQL Injection · high
    $1,50043 votes
54. Reflected XSS on multiple uberinternal.com domainsCross-site Scripting (XSS) - Reflected · medium
    $2,00041 votes
55. DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ]Cross-site Scripting (XSS) - DOM · medium
    39 votes
56. CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.comPath Traversal · medium
    39 votes
57. Reflected XSS in lert.uber.comCross-site Scripting (XSS) - Reflected · medium
    39 votes
58. SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/SQL Injection
    $3,00039 votes
59. Arbitrary File Reading on Uber SSL VPNPlaintext Storage of a Password · high
    $6,50038 votes
60. Reflected XSS on https://www.uber.comCross-site Scripting (XSS) - Reflected · medium
    $1,00037 votes
61. [data-07.uberinternal.com] SSRF in Portainer app lead to access to Internal Docker API without AuthServer-Side Request Forgery (SSRF) · critical
    $50037 votes
62. Stored XSS on developer.uber.com via admin account compromiseCross-site Scripting (XSS) - Generic
    $5,00037 votes
63. phone number exposure for riders/drivers given email/uuidInformation Exposure Through an Error Message · medium
    36 votes
64. HTML injection via insecure parameter [https://www.ubercarshare.com/]Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
    35 votes
65. API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers.Information Disclosure · high
    $75035 votes
66. Stealing users password (Limited Scenario)Violation of Secure Design Principles
    35 votes
67. Possibility to brute force invite codes in riders.uber.comViolation of Secure Design Principles
    $5,00035 votes
68. Reflected XSS on developer.uber.com via Angular template injectionCross-site Scripting (XSS) - Generic
    $3,00035 votes
69. Full Path and internal information disclosure+ SQLNet.log file disclose internal network informationInformation Disclosure · low
    34 votes
70. pam_ussh does not properly validate the SSH certificate authorityImproper Authentication - Generic · medium
    31 votes
71. Reflected XSS on Partners SubdomainCross-site Scripting (XSS) - Reflected · high
    $2,00031 votes
72. Reflected XSS POST method at partners.uber.comCross-site Scripting (XSS) - Reflected · medium
    $3,00031 votes
73. Full read SSRF in flyte-poc-us-east4.uberinternal.comServer-Side Request Forgery (SSRF) · medium
    $2,00030 votes
74. Subdomain takeover on mta1a1.spmail.uber.comImproper Access Control - Generic · medium
    30 votes
75. Site-wide CSRF on eats.uber.comCross-Site Request Forgery (CSRF) · high
    30 votes
76. 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl )Privilege Escalation · medium
    $50029 votes
77. Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employeesPrivilege Escalation · medium
    29 votes
78. SQLI on desafio5estrelas.com SQL Injection · medium
    $2,50029 votes
79. Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root passwordImproper Authentication - Generic · medium
    $1,00029 votes
80. Improper Access Control on Onelogin in multi-layered architectureImproper Access Control - Generic
    $50029 votes
81. Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilitiesCross-Site Request Forgery (CSRF) · medium
    $50029 votes
82. Exposed█████████in apk file - devbuilds.uber.comInformation Disclosure · high
    28 votes
83. IDOR in activateFuelCard id allows bulk lookup of driver uuidsInsecure Direct Object Reference (IDOR) · low
    28 votes
84. duplicate hsts headers lead to firefox ignoring hsts on business.uber.comMisconfiguration · low
    $50027 votes
85. Get organization info base on uuidImproper Authentication - Generic
    $3,00026 votes
86. Possible to View Driver Waybill via Driver UUIDInformation Disclosure
    24 votes
87. Possibility to enumerate and bruteforce promotion codes in Uber iOS AppImproper Restriction of Authentication Attempts · medium
    $3,00024 votes
88. pam-ussh may be tricked into using another logged in user's ssh-agentImproper Authentication - Generic · medium
    23 votes
89. IDOR on partners.uber.com allows for a driver to override administrator documentsInsecure Direct Object Reference (IDOR) · medium
    23 votes
90. Uber Test Report 20220301Business Logic Errors · medium
    22 votes
91. CBC "cut and paste" attack may cause Open Redirect(even XSS)Cryptographic Issues - Generic
    $50022 votes
92. Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.comPrivilege Escalation
    21 votes
93. XSS @ love.uber.comCross-site Scripting (XSS) - Generic
    21 votes
94. Cleartext password exposure allows access to the desafio5estrelas.com admin panelCleartext Storage of Sensitive Information · medium
    $50020 votes
95. deleting payment profile during active trip puts account into arrears but active trip is temporarily “free”Business Logic Errors
    20 votes
96. XSS on partners.uber.com due to no user input sanitisation Cross-site Scripting (XSS) - Generic · low
    $1,00018 votes
97. Stored XSS on newsroom.uber.com admin panel / Stream WordPress pluginCross-site Scripting (XSS) - Generic
    $5,00018 votes
98. Chained vulnerabilities create DOS attack against users on desafio5estrelas.comCross-Site Request Forgery (CSRF) · low
    $1,00017 votes
99. Privacy policy contains hardcoded link using unencrypted HTTPCode Injection · low
    17 votes
100. Golang expvar Information DisclosureInformation Exposure Through Debug Information · low
     16 votes