Browse / Urban Company

Urban Company

See its reports on the map

Attack surface: 146 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Urban Company

• Authentication2
• Information Disclosure2
• Misconfiguration1
• Server-Side Request Forgery1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Critical full compromise of jarvis-new.urbanclap.com via weak session signingImproper Authentication - Generic · critical
   $1,500123 votes
2. Broken Link on Urban Company's Vulnerability Submission FormViolation of Secure Design Principles · low
   79 votes
3. Host header injection that bypassed protection and allowed accessing multiple subdomainsServer-Side Request Forgery (SSRF) · medium
   $50033 votes
4. Private ip leaking through responseInformation Disclosure
   14 votes
5. Exposed data of credit card details to hacker or attacker.N/APrivacy Violation · medium
   4 votes
6. Insufficient Session ExpirationN/AInsufficient Session Expiration · low
   4 votes