Browse / Upserve

Upserve

See its reports on the map

Attack surface: 4,622 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Upserve

• Cross-site Scripting6
• Business Logic3
• Open Redirect2
• Information Disclosure2
• Access Control1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Ability to reset password for accountImproper Access Control - Generic · critical
   637 votes
2. Ability to create own account UUID leads to stored XSSCross-site Scripting (XSS) - Stored · high
   $1,500207 votes
3. Open redirect at https://inventory.upserve.com/http://google.com/Open Redirect · medium
   $1,200179 votes
4. DOM Based XSS via postMessage at https://inventory.upserve.com/login/Cross-site Scripting (XSS) - DOM · high
   $2,500171 votes
5. OLO Total price manipulation using negative quantitiesBusiness Logic Errors · critical
   167 votes
6. Reflected XSS on https://inventory.upserve.com/ (affects IE users only)Cross-site Scripting (XSS) - Reflected · medium
   $1,200120 votes
7. Payment method token being sent to 3rd party analytics serviceBusiness Logic Errors · high
   51 votes
8. Open redirect on https://hq-api.upserve.com/Open Redirect · medium
   44 votes
9. Blind stored xss in demo formCross-site Scripting (XSS) - Stored · high
   $50025 votes
10. Reflected xss on theacademy.upserve.comCross-site Scripting (XSS) - Reflected · low
    20 votes
11. reports.breadcrumb.com is vulnerable for Arbitrary file existence disclosur CVE-2014-7829 Information Disclosure · low
    $20014 votes
12. [theacademy.upserve.com] Reflected XSS Query-StringCross-site Scripting (XSS) - Reflected · low
    $25011 votes
13. Insufficient validation of sides/modifiers quantityBusiness Logic Errors · medium
    $50010 votes
14. Information disclosure through search engines (password reset token)InformativeInformation Disclosure · medium
    6 votes